{
  "id": "bundle--a1221cbf-146d-4171-bd17-67e5e2541355",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--nadsec-dionaea-enricher",
      "created": "2026-04-30T23:55:56Z",
      "modified": "2026-04-30T23:55:56Z",
      "name": "NadSec Dionaea STIX Enricher",
      "identity_class": "system",
      "description": "Automated enrichment from T-Pot Dionaea honeypot Elasticsearch data"
    },
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--nadsec-tlp-green",
      "created": "2025-01-01T00:00:00.000Z",
      "definition_type": "tlp",
      "definition": {
        "tlp": "green"
      },
      "name": "TLP:GREEN"
    },
    {
      "created": "2026-04-01T00:05:11.533Z",
      "created_by_ref": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "description": "Rolling monthly view of attacker IPv4 addresses observed by Dionaea honeypots on a T-Pot instance (SMB, MSSQL, HTTP, FTP, etc). Each run looks back the last 1h and appends newly seen IPs for this month. Location: Australia.",
      "id": "report--a1221cbf-146d-4171-bd17-67e5e2541355",
      "labels": [
        "threat-report"
      ],
      "modified": "2026-04-30T23:05:10.023Z",
      "name": "Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "object_refs": [
        "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
        "indicator--770ad526-8d8b-489e-b2e0-c03617869f9c",
        "indicator--5a94ffcd-9dbd-42a2-ab29-dc1c69faf862",
        "indicator--0ef48a76-5771-4d83-832a-c3ac9464f84c",
        "indicator--1976c0df-3a1b-441d-b9af-96a2b53aa358",
        "indicator--c9dd80c5-2bd2-4e31-8695-de63a4a30523",
        "indicator--9483e81b-db6b-4346-b130-62e8d5d256b3",
        "indicator--d10bd6cd-7ef3-4a22-915b-e201813d3919",
        "indicator--ce9e2d7d-e7f3-4015-8455-95c67f3fb6b4",
        "indicator--2801727d-2f71-409d-9646-e608f4d81c16",
        "indicator--0bc4cec3-6e04-4092-960c-7eec9005cb78",
        "indicator--0a500bc8-a868-42af-9f7f-f4272fdceaff",
        "indicator--31846280-4d44-4538-8436-b8352446afc6",
        "indicator--c6acc65a-c6a1-462f-b5ee-a75af12cc304",
        "indicator--e652071f-392e-496e-b700-5ac6a63424c2",
        "indicator--a0cc86c6-7e3b-4120-9a4b-011155910724",
        "indicator--7c627d8b-054d-40ae-956c-843a8e92ed5a",
        "indicator--2b3ef461-a30e-47b8-bb10-f0752e4eac3d",
        "indicator--806d193f-5541-40a2-9e2f-e9858875a1c2",
        "indicator--4077f294-2b00-432c-9d30-ed0acb56b856",
        "indicator--3062bce4-4e21-4683-a3a8-62e12c88c89d",
        "indicator--a49c1388-5d1a-415d-8e19-60f9590f2f18",
        "indicator--4519b041-a404-4c40-8adc-5fcbc3173540",
        "indicator--5714478e-848d-4f8e-8287-99d6c191391e",
        "indicator--906eb17e-e7b9-436b-a83c-2097a14aacb8",
        "indicator--33eeafce-6c1c-49af-966b-38b5fcd5e9cd",
        "indicator--f5f22478-a06b-452a-acb5-111a1bc3541d",
        "indicator--076015a1-f943-4c82-a106-e4b9a81f0d12",
        "indicator--f805a635-fb27-4be9-bfee-4ebbbaa82a6b",
        "indicator--ed173082-790f-4776-876e-e3b8d665e121",
        "indicator--83cf0401-2069-4004-b084-764a3e58a429",
        "indicator--898c8429-b1d2-4f4f-8b68-81995de7f599",
        "indicator--91ecd978-7d29-4910-90f9-570f0505e26c",
        "indicator--fb763fbb-1e0a-42d0-9ca7-982cd2e23a6c",
        "indicator--de9b0b4a-e2da-44a3-913b-5b69584dfe52",
        "indicator--32198403-abc6-43ed-8ddd-eb62d9f43890",
        "indicator--9b75d0b9-5229-4200-bd16-0deb2a202316",
        "indicator--8d137a75-d47b-4a07-ba20-98255e7a884f",
        "indicator--d34393b0-351a-4138-938a-b6de0924d055",
        "indicator--f4b9d443-8238-4f8a-bb24-9bdd9cd08188",
        "indicator--47d63bdf-7d31-4836-bdcc-6edc7f9507be",
        "indicator--6581586d-68fb-44ae-bde8-3dad6cbad269",
        "indicator--d3c0c2e0-3cf1-47a9-84fd-c2bb33c3eb4b",
        "indicator--38453f77-9097-4aad-a13f-77a21c90d2ab",
        "indicator--2a7c4707-a0ef-454f-ba7e-3bc9e7cec03e",
        "indicator--c7023b20-3091-499e-9e27-ca25191d2885",
        "indicator--6db49d8c-94b7-4925-96ff-116599121978",
        "indicator--54831fef-7445-487d-bdd7-fb58e256e251",
        "indicator--e5adfc59-2989-4ab3-a0fa-67853a81f457",
        "indicator--4bb6e567-2ce4-4570-8f68-b742566ca73e",
        "indicator--2813da68-b372-4b78-a294-fc38c697b44d",
        "indicator--58fcc6db-3cd8-4803-a597-453f4bac2d67",
        "indicator--046fbdea-8ca3-415f-b934-9635102da0ef",
        "indicator--90670556-e247-4b70-bc5d-7d18025d5446",
        "indicator--04c6c9e2-24fe-4a54-8f61-afcccdd349d1",
        "indicator--5e57edb7-aecb-4995-a880-bd29c8ed0947",
        "indicator--d72e1939-6fc0-4c3a-abce-dfa241e40175",
        "indicator--f2c50152-7d4e-4ed5-97c6-7468f28168ae",
        "indicator--c2760d42-3810-4bdd-b5b6-dbbe8697c7dd",
        "indicator--3231a295-d22d-4121-a1c3-c5f1a813a440",
        "indicator--77c54970-e76f-47a5-b5ba-a5af6762e3ae",
        "indicator--1cb0502a-5d41-40b8-8efe-6ad811e17e6c",
        "indicator--d1de4275-fa25-4bff-a718-97502f11a16d",
        "indicator--9525cd3f-a376-4380-988d-afaf37bfeceb",
        "indicator--68efc5bd-3f31-4552-bc5e-ef33af2d0417",
        "indicator--9308a7ca-38fd-46af-8109-827c15d8287a",
        "indicator--fcc72189-776b-4849-a504-45a3bb0c5b58",
        "indicator--193a4207-5cae-41db-ade6-4601ce88dea4",
        "indicator--a49cfce2-4b94-4fb0-a8b3-1011a4fa8700",
        "indicator--1a1cfd73-4b48-4d24-b44e-3e28b735b7a7",
        "indicator--02669d59-13b5-4a3c-b56f-216c46071f89",
        "indicator--be4f1d22-4742-4b33-a1b1-be71cac258e0",
        "indicator--42bfca8d-7dcc-43ee-a715-e7da09df5c53",
        "indicator--b2c58437-d29c-419d-b0da-e30cebdc9875",
        "indicator--835d8321-4a92-4944-a74b-7ec349bf418b",
        "indicator--8d974e63-f1fe-4fd5-b3fa-7eaaea32ff0a",
        "indicator--abc8b59b-0eec-4ccf-b636-e91ba591ecb7",
        "indicator--5a108da8-e64b-4123-bf7f-7acb61c24295",
        "indicator--7e5cfe02-7130-4ed0-b6ed-4074012e4467",
        "indicator--644f511c-ad18-41de-a645-5310b8d3d4b0",
        "indicator--280aa227-5550-4784-b502-5a5ffe002bab",
        "indicator--5be0178f-31c3-40f2-b4c5-9f9c66caf2bc",
        "indicator--992badb4-63b6-4474-a7ee-fac95ca5f33d",
        "indicator--9c46a9c6-8bf3-4fc9-bb31-297777e05f8f",
        "indicator--b18fd9d3-9ee9-43b6-a0b2-e60ffe01cae7",
        "indicator--1d452aa8-63c0-4432-b35c-5be7d418c6a6",
        "indicator--60d38d3e-c1c0-4e1e-abfd-e9417c598517",
        "indicator--e041add6-6fd9-4774-9271-cb0ae0289961",
        "indicator--d11578f8-dc37-4e7c-bf13-41662a7c2447",
        "indicator--b9a42f13-b49e-4114-bcaa-1995427929a7",
        "indicator--5b7e4a03-c667-40ae-b450-b97fa548ebf6",
        "indicator--0b67a56f-0a5c-4c67-9d4f-7a22de8ad548",
        "indicator--a0257466-f8b6-4831-9431-49dd88f8baea",
        "indicator--85fb7877-c1e8-4a65-9999-70a71b658435",
        "indicator--d6d09943-961e-4c6a-86d6-6e9698d988d7",
        "indicator--5dba5369-3f65-4d25-a851-d458d4cf809a",
        "indicator--93d1ec11-17ca-4f23-993e-d89b2b292e7f",
        "indicator--5e184202-3545-48df-b98c-6f1c0a7e2aa6",
        "indicator--28e7d3df-eb96-4ec5-b8b3-cd42398c8165",
        "indicator--04c7d252-f36c-4afe-8f77-b89166e955c7",
        "indicator--07243cf2-0793-4c7b-baed-4152f2fe4e80",
        "indicator--e9cb47f7-961a-48d1-9929-200611358fc1",
        "indicator--213ec726-fa41-43d0-b73f-f7bfea8d2b7a",
        "indicator--bbe1bbaf-8fd6-41ea-aa27-33209409c3d0",
        "indicator--0e20ba88-c146-45c5-a5c1-7c334ddb29bb",
        "indicator--0b81bb7d-8f38-4e87-b414-b22bb3376e1b",
        "indicator--89d2539f-0635-4859-8af2-0e3400bd14bf",
        "indicator--f83ec7d2-49bb-45fa-9bf0-c6cdfbd724cd",
        "indicator--33928a4d-7a40-40b0-8ad2-7ca07fd899a9",
        "indicator--2f469d99-b5d1-4135-9818-b6acead54128",
        "indicator--6d074322-278a-4fa9-bffa-b8487a891c4a",
        "indicator--ec2ae5b6-f187-430d-bac5-9fe29d521dc0",
        "indicator--08bf9ee2-b8a5-429e-b140-d106d734d225",
        "indicator--eb5fc83b-44fa-45a2-9154-47bd7412911a",
        "indicator--4a09cb11-3cdf-4e86-a166-0e81ff4623bf",
        "indicator--f8f95650-d614-431d-8f64-10c4108380f1",
        "indicator--f86bb645-7a45-453c-a74b-28abba15209e",
        "indicator--e4a4dcdf-cd5a-4cf2-84a3-63199a182ce4",
        "indicator--970f53c2-7b3e-4637-8a73-48ed05d4cabb",
        "indicator--1675bd2d-ae29-44c9-8f8f-5b9a94632bda",
        "indicator--f3ef22c0-40db-45d7-972f-618c8e0f57ed",
        "indicator--909bf079-371c-45b6-b52b-5c82a2714569",
        "indicator--9a2d189a-7d5f-4f52-822b-d1b11bcb3fa3",
        "indicator--2505a098-300b-4d24-920a-048ca2c1439a",
        "indicator--b7ce0d24-bc4a-4d77-872f-56724c402348",
        "indicator--dcdb0fe6-098c-40ef-b806-1128c11dccfa",
        "indicator--b4208529-a600-4664-a1a6-319c4a7e4daf",
        "indicator--66b85c25-fad2-40a1-bd03-7da681164d22",
        "indicator--86ab658b-fc50-4da5-98c4-f37da2978186",
        "indicator--13c7dbe2-ddab-4eb0-8058-3f7d9651aa8f",
        "indicator--3fdcf511-d7c5-4ba5-bf14-9c34f33da699",
        "indicator--3726b96e-4ecd-4dcf-a773-1320038d1648",
        "indicator--5f920d5b-8cda-4846-a87a-5b6f3972d160",
        "indicator--b697052c-d231-40fa-9654-44fd115494d5",
        "indicator--43ff2ade-52aa-4879-a9b2-350ec0b44a0c",
        "indicator--8bb3732b-822c-45c2-8f24-64fc4bd71509",
        "indicator--71894884-b42a-4b55-89d9-1af827ce5fab",
        "indicator--ede08bf6-4651-4414-9cbc-1111e268bbc3",
        "indicator--d3b3447c-ab29-48aa-aacf-8bf3e358df24",
        "indicator--e053c474-e851-4794-bbc0-2c7cf3b01347",
        "indicator--444dbf39-002d-4f75-8623-5c3544498b63",
        "indicator--0f89ed3c-fb0a-4cf8-a9c2-13e07ebe352c",
        "indicator--bb8e6496-4486-4b41-a8f1-6793cf8aad43",
        "indicator--e1022e2c-8ae8-4cc6-9fc4-c5f40d02923a",
        "indicator--b2dd1b72-0c40-4dbd-bd2d-c1c611b1db84",
        "indicator--56fb010a-38e1-4927-b5cd-cc6384555213",
        "indicator--a13e15bf-5503-4fd5-b783-dda0038db0e9",
        "indicator--54d9c037-23a2-4df6-9cae-e2e7594a1321",
        "indicator--4ed88d92-c020-46ad-9bf4-bbb7100f7706",
        "indicator--aae1fbeb-ded2-458e-a0cb-bfc0057643db",
        "indicator--9680d567-2b3d-4c7e-a94f-e15eb8f4f636",
        "indicator--09e2cc53-7c79-4d17-968b-90fa3aaed4e3",
        "indicator--056aa22c-dbda-4fe1-98a5-8a40b2ae7f32",
        "indicator--ede4d838-9012-4276-8bcd-025b28da3699",
        "indicator--337d46fa-17e9-4496-a094-ba40813a3925",
        "indicator--0c600559-d225-4a85-9a74-d00a2a38ab5a",
        "indicator--73b01646-8e8c-4656-9596-c1117dac5d35",
        "indicator--a5e0d6f9-66e6-47ec-8209-b6757d9cb3ce",
        "indicator--f5a522c3-9635-4d23-baa3-cb22dde04af3",
        "indicator--c748b2cc-0da8-4590-85ef-5becc37884fa",
        "indicator--91436eca-c96e-4bb2-b447-4f0ab8da8a60",
        "indicator--e5bea4fa-d8dd-4b68-a473-dceba64d0142",
        "indicator--db6259dc-b499-4c6e-beb7-a06a3de5fe33",
        "indicator--852ea53f-c91d-43e6-bc5f-2b0efba7a0e7",
        "indicator--d5b30679-0fa1-445a-9285-d1fb308b002f",
        "indicator--2c2a5f4c-08bf-47d8-bf84-931054b2f0ea",
        "indicator--72563dd9-6b26-4e65-b996-2fa13ddf39eb",
        "indicator--a031bcbb-869d-4da3-8846-2d29f1ee4e87",
        "indicator--7c8550e4-1c8a-4d87-9779-5d245e2e7fe3",
        "indicator--f0748849-658e-4bf7-bc48-408dc19ab6da",
        "indicator--61fcc6e1-18d9-463f-8dde-ca7b2ebfdef2",
        "indicator--997f6d04-72bb-4341-811e-060898241047",
        "indicator--ed43d389-8353-4756-92aa-1dbee91ae1c6",
        "indicator--f6862cad-bdc9-4ae4-b020-12ada9e9b4d8",
        "indicator--daad5f9a-cd82-4cb1-a33a-a1a7f9edbb61",
        "indicator--b9393dde-4ae7-4e26-af73-d81d37f89a47",
        "indicator--e61f5157-c377-4969-98f6-9e0eced07975",
        "indicator--ed0a506b-c46f-41e4-a5a6-0671d9499e2c",
        "indicator--c6eb07cb-86bc-459b-b925-161c1a110b22",
        "indicator--0d1f328c-6d31-4eae-97fc-3c0190c46f17",
        "indicator--b9a7e811-9c0d-4e9d-8356-d8ddaf3119c5",
        "indicator--4fe7e189-0150-4b4b-9ba9-44c31e5c587b",
        "indicator--69d59bac-bffd-4de4-8ac4-a7bfab7700c5",
        "indicator--06fa553d-0701-48d7-8c39-fa574142e950",
        "indicator--837a7d39-53d1-45c7-86c3-41f0557a0d8c",
        "indicator--333f863e-1c83-4a99-a548-a8190b55624c",
        "indicator--7430fa29-7cbc-446a-a426-92eb410c1ddb",
        "indicator--2c9dde4a-5ba1-4b84-bae7-3a5d0d44e170",
        "indicator--b772252c-bcb3-496e-9dbf-e665d7ba0a1f",
        "indicator--1ea0a2f5-3c76-48ef-b55b-a6e960f175c8",
        "indicator--9f20f149-0ef4-4dca-97e0-c643e079738e",
        "indicator--7f3e8252-9788-4b7f-ae39-27680ce0b349",
        "indicator--37d869a9-bec9-41cb-aebe-bcf710772d97",
        "indicator--29df78dc-5d9c-403a-bd85-2e105be52f3f",
        "indicator--fc058976-0b90-4df7-96cb-0a7315db9f7d",
        "indicator--2444d111-1635-4c3e-9486-1d92be0434a1",
        "indicator--abbb9b33-1484-4925-9dff-b971832eb102",
        "indicator--e87928c4-972c-4a05-8fef-cb0a404ac928",
        "indicator--e83909fb-cc4e-4ac6-84bd-84ae9bf82ab0",
        "indicator--70cc8b55-368c-44c1-ba3d-2edf18e4744a",
        "indicator--2e28c6f0-d2f3-4479-b0dc-fa35edc80ab1",
        "indicator--210433d7-83d1-4f33-af00-66b2da3511fd",
        "indicator--92ca091d-2fdb-49eb-abfa-3cab754ffb27",
        "indicator--4b82fd94-d160-4274-8198-de36134f7148",
        "indicator--e4be1f57-6a11-4a8e-b96c-2c437f6359c8",
        "indicator--740bd255-9e2e-491c-bac2-d757fe70bec0",
        "indicator--59085736-d867-43f6-bf97-0f1cf25a28af",
        "indicator--e70ff5b8-c1de-4c78-b0bd-cfca48cf3564",
        "indicator--7b9a7694-3b51-4ec0-b3b3-e0b64fb2c200",
        "indicator--5fc697a2-cecb-4003-947c-9f76338adaa3",
        "indicator--ce1fc6d2-88e3-4589-9c2f-ca16018dae9e",
        "indicator--e6a53644-490d-4e94-affd-c02072a4ff43",
        "indicator--2360db1a-be83-40a2-b332-e01c42260786",
        "indicator--2b3648d7-67f5-473a-89e3-3644017172f0",
        "indicator--85c4d0ab-1381-4235-bdcc-8d4f09586ff3",
        "indicator--fea5da50-a595-4d29-9b3e-622a98b653fb",
        "indicator--4f72c373-fb9e-41b6-a704-093d0acc0fdd",
        "indicator--e569db8b-c847-4de8-8433-ed003a2201c3",
        "indicator--c05a083f-9807-4fe8-abd1-898440834dcc",
        "indicator--42d30a3b-b02c-436b-a749-748175d847d9",
        "indicator--5ea5a271-9e38-4f11-993f-d7263f528e0e",
        "indicator--6fe99a61-e033-4f1f-889c-b5250d94a28f",
        "indicator--a65559bc-017b-4418-a790-8a4f87c22142",
        "indicator--62927db6-1af5-48f4-ac83-97feade90ed8",
        "indicator--fb31bd08-44e0-4301-8fec-1c5363bb211f",
        "indicator--cbae1715-03f1-4b03-9c28-42ca1b21b690",
        "indicator--bbbe4206-050e-470f-af0d-41b7d9303037",
        "indicator--d75debf7-57f1-43a2-9fd2-98addaed91cc",
        "indicator--7b39d916-7e15-455a-a5a4-688a66c1580e",
        "indicator--f8450206-7cc4-4008-81d7-91077407de2e",
        "indicator--65610f03-a81d-42b4-a28c-7238d7a6f0f5",
        "indicator--5ff5af9a-143c-45a0-81c9-858b85bd6fdd",
        "indicator--f19ad781-49b8-40d2-8485-9fd22fca024a",
        "indicator--db7a33f8-383a-48e5-8ecd-d39459e00d74",
        "indicator--2877e925-6055-4291-bf0c-641cf2a4c662",
        "indicator--badb3791-2e98-4cc7-bb90-660571f14baf",
        "indicator--5ee36acd-4492-4b81-af8f-a7b19bbef225",
        "indicator--eb4f79ce-f2e8-4fd5-b438-4534cd1fa9c3",
        "indicator--b7376888-7fc7-47a8-9e4f-32dd11f22eae",
        "indicator--e1f89d18-6544-4b81-9d41-62d4da42845a",
        "indicator--c6b2be29-7f76-4085-87fd-2a6c742efd36",
        "indicator--e12b7f19-028a-488d-a00a-4f20600a4e67",
        "indicator--0c66f612-c4f1-4a2c-a93e-b4afb67a376d",
        "indicator--f272a864-2c0c-444b-99f0-5aa65fb85e30",
        "indicator--b830c0c8-e8b0-4e54-a3b2-56343c869980",
        "indicator--d9177002-392c-4c7c-8311-e65f8cd356c4",
        "indicator--f9bb3408-fbf6-4d79-a449-23f4ecd2679d",
        "indicator--5e9026ac-323e-4325-8685-c5d88079c34f",
        "indicator--91ae114b-8ca1-4a7c-85b3-3bb9e1e0efc0",
        "indicator--d85f8f93-648e-4f08-80e8-a653d16a567c",
        "indicator--da279b55-d8fd-48a3-8313-c9f86cdaa466",
        "indicator--9bd1871d-7259-4974-bef6-a2a76341b325",
        "indicator--9446a48e-7e4c-45f5-b227-66e8e35f9d44",
        "indicator--fca223a5-a914-43a4-8213-f9996d859ff9",
        "indicator--ee789d8c-e31d-4c39-b530-b7da74dd83b7",
        "indicator--1ef7a277-8d27-4441-8a26-d99ea9506f3a",
        "indicator--bd421caa-f48a-4e06-94a9-91e19015cef3",
        "indicator--4d2c0a9b-6cfb-4e44-82e1-880ca15ee12c",
        "indicator--e7504330-b5d6-4e44-9dd8-36caa7c5a215",
        "indicator--96a1cc5a-7934-4551-82e3-a4095699cdae",
        "indicator--288e9699-7ee2-415f-aaf9-9b850e2ce191",
        "indicator--707de3ae-33a3-4639-9313-ce120b6815c2",
        "indicator--d96b6e2d-6593-4863-a32b-4100845f89fd",
        "indicator--780c6de9-1122-4245-b2e9-e087c6ec5cee",
        "indicator--3b41e358-ba7e-4339-bb63-933db3f26417",
        "indicator--4a026e31-1c9f-4060-8c0d-9cffb432c1a1",
        "indicator--dba10abf-5f3b-40f2-8203-2513b92f350f",
        "indicator--7c91e470-33d9-489a-bd4f-a7409086c8be",
        "indicator--6fbcbc62-d35a-4145-8298-8a84d6eae69c",
        "indicator--44e81021-8a61-4676-bfeb-7ca414459420",
        "indicator--47f82de9-c5bc-4478-9d52-6f6f22b791db",
        "indicator--513cc836-912c-41d4-a171-7fce9d9b0091",
        "indicator--ca003151-c04b-497e-870d-79b14888dc1c",
        "indicator--7bf855b2-2c0f-4087-9891-5b8464f4f553",
        "indicator--93a04f41-0546-4637-b977-ed710917fcc3",
        "indicator--e5798e05-ef56-4660-837b-419c231d0d5d",
        "indicator--c62c3d45-6729-4a8b-8dc4-33f5f365ad35",
        "indicator--d577b099-401b-440f-bbc8-cdc3ce426d2f",
        "indicator--92ff04ab-3609-4760-9793-9da9a52fb2e5",
        "indicator--4d026314-70c3-4a18-8f6e-cd935a33f092",
        "indicator--239acffb-0653-4333-9d9f-86af7e0948fe",
        "indicator--e0ebcb8e-9b53-4eec-9cd7-e3b17c914919",
        "indicator--55414aea-b0dc-450f-a4c5-c8bafa270a3b",
        "indicator--80b18d38-7916-4b4f-8b2d-0e980544d5a4",
        "indicator--9c31a03e-8e26-47ec-ab68-b781e973033b",
        "indicator--a873dbe0-a947-4010-9f36-5bc11592e8c4",
        "indicator--d3fc55d1-784b-47b9-9d74-24af12133dcd",
        "indicator--d21a451c-f2bb-48e4-90d7-c906652c7ad6",
        "indicator--2f3b7a13-b697-4c52-915d-788ca7ecbd78",
        "indicator--fba797f0-8312-47ca-b6ad-0f566d6414a9",
        "indicator--fd9d18df-81f6-4018-9a5b-e119ae76ee99",
        "indicator--c803bcb5-9623-47d1-84e9-1606d7ab4c11",
        "indicator--dcf8b7a8-c368-4a95-b2f0-f93ea583149d",
        "indicator--8a0528da-1164-4619-8fed-cdaa320d5ef1",
        "indicator--1eb37ccb-b9f1-4e10-bd96-a8870587dc50",
        "indicator--87cc1600-360b-4577-be70-f0b4540cd504",
        "indicator--26406a51-9c03-4993-890e-0a6ae256c54c",
        "indicator--e73c4ab7-ae70-499d-bba2-ef0e9fe42204",
        "indicator--a7a149d5-0fa1-4fef-ba9f-09a2c7a6c1a7",
        "indicator--cc248ede-5682-4db8-8511-7d8d9ba2d4a2",
        "indicator--cff03fcb-b399-430e-908f-ec7b3b7d4087",
        "indicator--f94c61fb-7bac-4c85-a98f-caf4f6a8d054",
        "indicator--c9098ecf-2bb4-42c5-a9d5-968cb58d261d",
        "indicator--4e415361-c5ef-4846-9e13-b70dfdce3794",
        "indicator--8e4c6cfb-fd4e-4f5c-8385-75231417140d",
        "indicator--1d97ce7b-bc4f-4c63-9488-01d5b12b0147",
        "indicator--f588182d-d02b-42fc-a334-4446be7ecf75",
        "indicator--d582ca9c-0afd-4f9a-a041-078135f0c5c2",
        "indicator--e59616e4-73bd-45dd-bd9d-e1b2203426b0",
        "indicator--7fc6e8b0-fd36-4204-a8c1-67a83d80e114",
        "indicator--b391bd22-e433-4e9f-b575-99dbbde563d4",
        "indicator--3089ff16-c361-4e16-bf22-60b583437de0",
        "indicator--8200ecd0-bc36-4fa4-8860-6e71a72a85b7",
        "indicator--db81c215-aa54-46a7-991f-e56e29be14b4",
        "indicator--c105fbe8-6e24-4257-a593-ff49691f5bc4",
        "indicator--e1b31de5-e9d0-4d8d-9741-4f175950d88c",
        "indicator--7af4defa-e5da-46fb-b3ee-5e202b3cf2f2",
        "indicator--941fdd3b-229e-4844-9cad-8a7999ce3529",
        "indicator--53f9a07b-dba2-4595-963a-22c1b8db0e24",
        "indicator--ad9c898a-2fa8-4847-9749-9f6dd1cad4df",
        "indicator--1c8db237-cc6d-4c88-a068-f1382fa9faf1",
        "indicator--09ecad27-90b7-4118-a8ed-4d2cce33c24f",
        "indicator--05055fa6-32b5-452c-b531-ab76bcff14df",
        "indicator--89442728-e116-49b6-8fe3-926549456edb",
        "indicator--374ccfca-a845-4b18-9eb0-1e7cb8ad94e4",
        "indicator--148a4632-51fa-407f-8b87-2a49cc577042",
        "indicator--677429ab-94f6-49e6-8cf1-9a83d6f47757",
        "indicator--1951893d-25d6-4ebb-89af-637c4781093d",
        "indicator--a687c30b-99fa-4a8e-8964-360f4d2ecdfc",
        "indicator--9a786440-dd6b-4763-9dad-8fa274b96f08",
        "indicator--a91a4577-ace0-40a1-b511-f3037cee1c77",
        "indicator--ccab55e7-1943-4a4d-a220-a68304f3cf21",
        "indicator--6b489307-ae45-4d8a-b085-de93b06e001e",
        "indicator--9c35d4e5-91ba-4f60-ba9c-b999144e4297",
        "indicator--f1ec5304-3ec8-4bf8-acef-6df427d74888",
        "indicator--d1e610b9-9123-40ae-a748-4404a69819f9",
        "indicator--db4c89bf-652f-4fe9-b1eb-684d4db79d66",
        "indicator--30046831-f0ee-4aea-bcbd-ab665534bb07",
        "indicator--96ed20e9-41e0-4ced-b520-c6d2581c0cb4",
        "indicator--53785ddf-b011-4d39-9d88-7da7963df6c4",
        "indicator--c334fb2b-bb9c-4633-86e5-3bdc2876ccd1",
        "indicator--b6eaa1dd-0f4b-4d62-bdfc-6213730b79c5",
        "indicator--0c1e8635-9782-4d7c-ba2e-a454b184b63e",
        "indicator--90865a5b-faef-487a-8a10-c011c035c511",
        "indicator--7279c7c4-ce52-43c3-b54a-7499e55e652c",
        "indicator--c5bdec3f-6172-4274-acf9-3a007a2db1e4",
        "indicator--34f3e1d0-46fc-443c-ba4a-40e8b52feddc",
        "indicator--65df4e03-92f9-4e39-a2cb-7807d45497c8",
        "indicator--39f63664-41cd-40c4-98eb-58a3504f764a",
        "indicator--a39ee134-333a-44da-9a7f-17d1d3853cdd",
        "indicator--cc0f9641-d1c4-4acf-8690-876185165e80",
        "indicator--fd467b3a-2387-4f6c-8dc4-155e828a654a",
        "indicator--63ea2fe5-3504-4c42-91d1-bb2cfb1521fe",
        "indicator--9bff84d8-62fc-4ab0-937e-343cfa70aa24",
        "indicator--5a7bd409-0241-4f5c-836a-b9bdcc22e76a",
        "indicator--01e5e134-de33-4e3d-9156-b799f9bd3df1",
        "indicator--2090e8b6-d770-4201-8631-5dd09abd8827",
        "indicator--741b96a9-c256-4eb6-bc10-7c7ac911e7d5",
        "indicator--4c2a4cf6-63be-4fd4-929f-1dbc1b09a4b1",
        "indicator--20f237fe-068d-4260-bfa2-71bdfffb3dd7",
        "indicator--e9efad2d-90af-4d7b-b171-0050bbb69c7d",
        "indicator--55a6aefa-a124-4f4f-b456-b38450658a2a",
        "indicator--cab4e501-e9c3-454d-96ce-254c2545f857",
        "indicator--4ad24fb0-c143-47d1-9106-25188217aae8",
        "indicator--33303d6b-fe49-4165-a0a0-2fb0c5a116d6",
        "indicator--6a2f5078-26ae-4bd5-93f2-8ce8f89180b5",
        "indicator--04a8387f-61ea-48d8-974f-b9dd09f40661",
        "indicator--51bf24f8-03e2-4193-a46b-c58b98853961",
        "indicator--b44af9f4-233c-41e3-b417-0ad1e81d2a6a",
        "indicator--237f3d25-1633-4a60-9fd1-b8908e50d43e",
        "indicator--9ea72ef1-9d51-474d-b378-3e5447de4db4",
        "indicator--9bbe0154-c2a4-4e15-9b32-37bc00c8ebf3",
        "indicator--d3880c36-f8d3-4590-a2a3-fd2f182caaa0",
        "indicator--215f213d-c94c-4182-8c7e-35eac150dbfa",
        "indicator--95ad3ab5-7bfe-4e5b-bdd4-b09c7fa7cef1",
        "indicator--b19f4d32-0750-4a4c-ad80-39d6ceaa8c70",
        "indicator--c674b8f4-2f13-4440-9862-7bec575b792c",
        "indicator--7aa68958-3c95-48f0-a126-e005369c8d91",
        "indicator--5d63baf6-d141-491d-9942-a620bd16b959",
        "indicator--aac4009d-5844-402d-ab45-b7f9e5b08497",
        "indicator--210b125e-b273-4dac-a1e8-fa3bbfc07da3",
        "indicator--d1a42cae-6085-4cff-9424-8484d3df771b",
        "indicator--e097662c-92d2-4145-85ed-e92f095ec80d",
        "indicator--f624f21d-fc34-485c-ac0f-d290b2b71d4c",
        "indicator--7c7abf33-9d98-458c-85c3-2f0c326afcd9",
        "indicator--d58c2416-3a3b-4ae0-861d-91b6a08d327e",
        "indicator--5c58ee28-0d35-4a43-a1ce-6ea19f6d1fef",
        "indicator--a366b5c8-28b0-4467-aabf-98f57f99f01e",
        "indicator--581fee53-0e54-4025-a489-bbbeea5216e5",
        "indicator--54be3e1b-53d0-43bf-90fb-71a112ae6958",
        "indicator--3acc9ec9-ea82-449c-b318-c97a5ee7ac4a",
        "indicator--6ec9b8a6-8aa0-40bd-898c-413bbb2ba40b",
        "indicator--e73dbb0c-a027-4bcc-9e85-aa1640529afa",
        "indicator--5d9f34a8-c784-489d-9695-7de1b4f02102",
        "indicator--c3644ed9-3b81-4177-b57d-550a58eb3e17",
        "indicator--bfdbfe97-220b-4ff6-9a5c-0e4389746de7",
        "indicator--96e9d31b-1163-49ba-8f5e-d1d1ebcf44c1",
        "indicator--9758775f-0df4-424b-b038-26bfc6b9a5ac",
        "indicator--9e6ce2f4-e047-422b-a0a3-4315e4c07aca",
        "indicator--71aef8de-ea9f-4cf7-97b7-61490543797c",
        "indicator--7ee49255-dd72-4d64-9ca0-81b255a99fe9",
        "indicator--23edc2dc-8341-4760-8619-0b35d52c4c14",
        "indicator--635df4c3-0652-4384-8de0-1a142a5c9f0b",
        "indicator--1522fe6b-1b0d-4c91-b5a8-a0e10506262f",
        "indicator--70aeb7cb-95b9-4d61-b418-21c01bb2076f",
        "indicator--f0062450-8d01-4199-8eb7-74149f2947c9",
        "indicator--8f2a0275-ef02-469e-93bf-404feba09a91",
        "indicator--dbce38f0-6cb0-4311-8e7e-7f55b524e8fa",
        "indicator--c9dec768-54fe-4627-828d-785930ef029a",
        "indicator--25c2e7e7-40ee-431d-9ac4-fb8c0ccf2a78",
        "indicator--ad54f6eb-704a-40e3-9ea4-623686b2e675",
        "indicator--cead9340-e8eb-47d5-bd9b-47fa9bc81fa1",
        "indicator--7280e47c-cde8-4282-9d73-d1cc2b719f41",
        "indicator--6c16dec4-5482-4b3d-ba72-4374ea4475b8",
        "indicator--77921432-6466-4e02-904e-fd12548ce0b3",
        "indicator--0a3ae167-0f11-4a71-b248-622c57c94a38",
        "indicator--e3afdc69-7fc5-480a-9d84-9d9df46b2877",
        "indicator--cc910ec7-2a6b-4b05-ae96-c52aad4550af",
        "indicator--eb9a35a4-209d-4688-bc03-92105c073af5",
        "indicator--8d6218e5-814d-4bad-b6a5-f6b8d178475c",
        "indicator--03f04453-f7bf-49ba-9ff5-d387f359dc38",
        "indicator--1da06069-e4e2-49eb-8076-a53f406bccb7",
        "indicator--f66e3b9b-6151-49ac-a278-2accd9e2af89",
        "indicator--22ed2c9d-1360-4001-9164-6a7e5e1b327a",
        "indicator--390ea71b-063a-4ebb-b53b-99b8970a6b72",
        "indicator--3bdb222b-d635-41b5-9b3a-a60e00532a57",
        "indicator--e0835a71-a575-4f39-af2f-808ef78e3cad",
        "indicator--448df429-7a8b-421a-8d64-202af5afd12f",
        "indicator--26a250ec-aa8f-4775-854d-20d0b3716056",
        "indicator--f862750a-1364-4ac3-8d4a-d0cb0fca9f7d",
        "indicator--40ab60d6-1f51-4a31-b774-ec099d8580b0",
        "indicator--ee1f114d-c564-46d5-8161-c8ccec60d8d6",
        "indicator--8be5d4f2-2465-4a2f-9c98-ca73bc20b517",
        "indicator--211ddca1-2e1d-4e0c-9764-b6231e5fe5f8",
        "indicator--3da8ebb0-1b1c-475b-a9e7-77989258a8cd",
        "indicator--b9588c94-25ca-4a34-8946-ecf74dc7bdba",
        "indicator--58049f56-30c8-4afa-ab5c-128f67584392",
        "indicator--3db6ac52-6c4f-4e65-b847-d648d0d955aa",
        "indicator--00243fc8-dc7d-4c7d-9769-2dd3f83a05b5",
        "indicator--2fdf135c-f7d4-486b-9efc-eec7121f0d48",
        "indicator--2f5937b2-b984-4c17-a562-0a7388fc1f80",
        "indicator--46a3bc73-7c1f-4a2d-9593-462207dff9c1",
        "indicator--22838282-79e3-4d7b-a470-b434513f7856",
        "indicator--fe695f2d-a143-4d53-9ff5-cda847ef5901",
        "indicator--eb0c2cc5-3356-477d-ab73-715464d23f54",
        "indicator--08fb4558-52d0-44b6-a2f2-264a051d5fbf",
        "indicator--6a0a765c-03d7-4e96-8c00-122ac6769711",
        "indicator--955788cd-d3f3-47a9-ad3e-b52da5155980",
        "indicator--a9fa7926-f0f2-4946-8591-2b65b7b371e6",
        "indicator--29c24912-3846-4f70-8fbd-7807dc152585",
        "indicator--c95287ec-b7e6-46fb-84b4-a765cb9ff621",
        "indicator--096fd641-1529-4971-be0d-a1de640e09a4",
        "indicator--a4c882e0-923c-4618-8eba-3ce631607452",
        "indicator--632b18c7-a1b7-42ce-9144-b3d3c8d8b79a",
        "indicator--90075e26-3bad-4436-9eb8-61b571e0c3bd",
        "indicator--f1c04873-7208-4f7a-8d22-ad5028350d27",
        "indicator--e822348b-aec2-4e52-8ec7-7dbc9c785f1c",
        "indicator--6a4cf02f-4f5c-42a7-a890-cbec26368e05",
        "indicator--95e58966-14ea-474d-b4e6-6c2f3b8eaf38",
        "indicator--6aeec5a0-78bd-4b9f-90e3-8c1e7b9659df",
        "indicator--97f5ab4b-2c8a-4b1b-855d-3c63d2a20e91",
        "indicator--533156ae-aedd-4211-af56-54c9a87b1ad6",
        "indicator--6a00c25f-11c7-48f9-bfef-9862879271f9",
        "indicator--a06d57a3-6d69-47db-8d9c-2a46d5bc8192",
        "indicator--356f30f6-e511-4a1e-930d-07b98cdd73da",
        "indicator--f0ccb702-45f3-4a48-8826-4ed95b675391",
        "indicator--49c4953e-b0e9-4f87-9671-3a78177ce59d",
        "indicator--fb22eaf4-36ed-4459-8edd-59e48d38dc9f",
        "indicator--258f9adf-d3ba-47b4-9c55-6d1e48f1d39b",
        "indicator--ec9dc9b8-d752-43e9-b5a1-dacc46bc7d4f",
        "indicator--a06b0608-4886-4f58-a792-1f8efd0a3345",
        "indicator--26046a71-8a61-45df-9908-df2694d972f6",
        "indicator--77031102-1e5c-4cff-9f4a-6eb2ead03ef2",
        "indicator--fa5ee95b-cb79-4002-9c34-340e8990d513",
        "indicator--d3d206f3-8349-4222-92d4-67489beace8d",
        "indicator--ff5dc5ca-5de6-410a-9b17-ab248514723f",
        "indicator--917355fe-5f38-4b46-8f63-ddc8e417f93d",
        "indicator--221c2636-d37a-4ec1-a6c0-678c58f6dcf5",
        "indicator--cd138068-f2cf-4e63-aeec-c6556b48fc7a",
        "indicator--da92ebc7-96eb-4d8f-8acb-de86e55ce09e",
        "indicator--512a5016-5c4f-49a0-b58e-c9e6b76132a2",
        "indicator--397b98c5-e861-49da-9fc0-3cd77bfd2c6a",
        "indicator--97552c77-ae80-40c5-916a-c82b45869748",
        "indicator--a599e3b6-1cf9-4447-ac6f-ff1561587dcb",
        "indicator--65496c9d-9f6e-4cb4-bcf3-9654231a3ce0",
        "indicator--5d109097-8b49-47f3-9284-f3b04fc7d110",
        "indicator--d0e50b40-1aa4-4555-87e1-6cc0cff846a9",
        "indicator--793007cb-267b-42b1-ae1c-13a49f7c68c9",
        "indicator--8c4cb910-9a56-4f6d-a25b-0c8cfeed0f31",
        "indicator--1d36807e-2d4f-482d-a6e2-6eb357639169",
        "indicator--6c0f6e20-6f4d-455b-a9d0-8532c2a84abd",
        "indicator--0e779e73-9071-4794-b3bb-737b97b7ab83",
        "indicator--0c3eead4-8f85-4c47-b954-d70ae6e1d0e9",
        "indicator--e19ada8e-071f-4f34-9b7b-df295da2ffca",
        "indicator--7b30cf68-e6d3-40fd-b532-f883571ddc93",
        "indicator--b8268bfc-5c98-4fb1-a71d-e37f200a7592",
        "indicator--ba544025-1fd6-49d1-b810-dde8363986ba",
        "indicator--9341b990-5d27-4a6e-bd56-351ba647eb05",
        "indicator--3ac03743-242e-4f39-8d1e-a691466f80aa",
        "indicator--fc6a62d4-3621-4c46-880e-6dafe987491c",
        "indicator--6face142-5525-47fe-9bfc-ce797db0f2cc",
        "indicator--fa08a2a2-89d3-4c56-a2cd-ece575ecbc07",
        "indicator--c492e768-325f-4a50-82e6-43f529f54051",
        "indicator--d1be2d62-4093-4637-828f-dabff3a7fdfc",
        "indicator--3308ce26-ce6c-4d80-a253-5a75261bdda7",
        "indicator--6b57b974-65ce-40c1-9b01-0b33ce04a03d",
        "indicator--1351e28d-90c1-4d3b-9013-98c90792cd0b",
        "indicator--e28225b2-baa4-481f-a59e-3c594ab7f92b",
        "indicator--c7b85c07-2572-4434-b1b2-6a595f764dc5",
        "indicator--61569488-2bd7-467b-8e28-1f4b1e272878",
        "indicator--a60879b8-e50c-415e-a618-7293a59e5851",
        "indicator--d934f1e9-b985-4f34-8ea6-166fbee850c9",
        "indicator--11fbe8e3-96ff-40c9-9aca-41f9092ac1dc",
        "indicator--a57293cf-189f-42a0-8bca-d67453289309",
        "indicator--b58ed04c-fcce-4669-9926-f83d21267649",
        "indicator--9cf74dc2-98df-4ac7-965b-2681002e11f9",
        "indicator--71fa9a05-b14e-4624-bbd6-17cd74b2bd1d",
        "indicator--ed42c9a0-3a74-4cef-929a-b8ad71df97f3",
        "indicator--febbebd8-b5f1-41f9-8623-ec5e32608935",
        "indicator--91912259-f5a9-4ad8-9186-f55782f00686",
        "indicator--6cbe56e8-72e0-445c-81af-5b40b8a9f003",
        "indicator--4685f6ef-a0a2-440e-991f-935e8069f7bd",
        "indicator--07ab7a41-a7e5-4d54-ae39-71fbe9525f2c",
        "indicator--f35c260b-42df-432d-9de9-77fea4140c59",
        "indicator--b058ba1d-77a0-4416-b892-42899a20f985",
        "indicator--5a42249e-1aaa-48e6-afb7-200fb1641454",
        "indicator--c05a43d1-fbe9-4f6b-9fe0-80b56aae9e8a",
        "indicator--e5477bac-e063-4084-8069-37a990bc237d",
        "indicator--19104ba8-7aab-4de7-b79d-dadc6bf98fcc",
        "indicator--918e69e4-89f0-408c-9c8e-a8c8467dd540",
        "indicator--a366aacf-d8de-48d4-8eaf-6eb1d15437b9",
        "indicator--975c5182-1ef3-4013-bce1-2ff3dc10c96b",
        "indicator--7201f965-c55a-4ccb-a0ee-5d33fe7c9240",
        "indicator--9e034cdd-3d83-43fa-85e3-4add99331489",
        "indicator--f0d1a70e-b01d-469b-b532-2e0a9ae5081d",
        "indicator--c0fd4250-2eba-4251-81c3-e9931f08d9a3",
        "indicator--e60bbfca-3497-4136-bca6-9e664e875f2f",
        "indicator--c9c82276-de8b-4ecb-b660-01cc09a4be99",
        "indicator--8fb69c7f-367d-4c2a-a2b5-888d0a47288d",
        "indicator--e4eb50d3-32d2-4630-b5d5-ab8807c06673",
        "indicator--9ea85545-90d1-4538-ac92-e2d7edb9202f",
        "indicator--2995f56e-39d3-494c-a891-f6f68630a2fb",
        "indicator--ed0e731c-6ad4-48ac-813c-0722e3ca318c",
        "indicator--4f9c2acf-dbe2-4dde-a93b-316ab57efb40",
        "indicator--54180ae1-7382-4c59-bf68-7374925a65cf",
        "indicator--476123b0-727d-411b-ae11-feaf2b68ae73",
        "indicator--d109394c-5075-4ad9-9a09-6f4ef96eedb5",
        "indicator--09d09e7e-b1e6-4785-8a90-da1b73d349c5",
        "indicator--9b9b86ef-c95b-4bc9-98b3-0dbbb5c478b9",
        "indicator--4838a857-7096-4f1c-930b-cfdf37a4ad5e",
        "indicator--a31b6d67-ef2d-4fcf-8e4f-e6deb065abf7",
        "indicator--e2b0662f-a8f1-44b2-a04f-17ecc9bc8996",
        "indicator--10b1e698-4e41-412c-b68f-2b9fe48f1ee2",
        "indicator--6933ece4-f029-4246-adf7-a0d5a5fd7ce1",
        "indicator--d0acccd8-b5d0-4bbc-98ed-1678efa35438",
        "indicator--ade7fa58-ad22-4c72-888a-733746357af2",
        "indicator--a71551c8-c6d1-4a93-ae50-2cdd5e75a482",
        "indicator--1673e375-0cba-4e80-9872-ca6e74a3a584",
        "indicator--0e7489d2-51d3-4095-935e-8f6ea16f0179",
        "indicator--2ae2a26c-2f47-4a53-93b1-7686e1979e49",
        "indicator--57884685-6ead-4bde-a54e-0dee4f43b86c",
        "indicator--409b7e88-af8c-4075-8179-62492ba1b5b7",
        "indicator--c1b6fa27-9e1b-485a-bc2f-4212574443c8",
        "indicator--50215676-92e4-4594-a825-508f37edaf84",
        "indicator--df3e6c5d-6f24-42ee-9e4f-c87b663179a2",
        "indicator--a9ce9200-e721-4e4c-8371-616cccbcc747",
        "indicator--71445c6c-730f-414c-875f-20e5e4cd3044",
        "indicator--b5c86279-e9be-4c16-8395-97243ffda095",
        "indicator--a84cb977-515d-4a1d-b277-9f0414c17e0a",
        "indicator--6635ff1e-5e71-455d-8738-d86bc1a52700",
        "indicator--44a3e561-7aff-4861-8d2f-ede61e2e82d2",
        "indicator--182707d2-c789-40c8-b64d-ad3a5df02447",
        "indicator--41eff508-cf9f-46cb-9dc7-999c952d0089",
        "indicator--858f6349-b242-41fc-a083-22bcd579e0b4",
        "indicator--2f382722-fc1a-4161-9a30-70c097aa433c",
        "indicator--1dca32d0-c08c-40aa-ac31-c829f08aaf1e",
        "indicator--981781e1-104c-4fe1-b308-c36ed51628f2",
        "indicator--519a5c00-ea9f-4af8-b014-da77f9dcc0b1",
        "indicator--3616062e-2a2c-4f25-b0e1-bf0185d80ed2",
        "indicator--72cf6dd7-60c9-4bc5-be24-3caa301afa36",
        "indicator--b6c58546-be9d-468d-a0a8-1f19b0bd953c",
        "indicator--dc0aac8c-b919-4e47-b170-f2cdf1f40097",
        "indicator--99106802-69bb-4a65-9e57-56529d0ba3d3",
        "indicator--cbee7a13-5374-4abd-a216-160696ec89f8",
        "indicator--e4ebb833-caa9-4098-b465-4b3d5c012f64",
        "indicator--9ef7e4c1-b31b-41c8-8139-8e4c3ab95c13",
        "indicator--7bd474ad-605f-48d8-a536-7d8c7fe2a861",
        "indicator--9d28318c-d8e0-4ea4-a03b-c350589d2c95",
        "indicator--5882e020-e7a4-4ec8-86d3-a27f8c926621",
        "indicator--0724f7e5-0c55-4fb9-bcce-28856ef6f5a9",
        "indicator--fff160e9-0dae-490c-a3df-3f794b4fb3ae",
        "indicator--07172e1b-3531-4897-9d3b-cd5a56df8c49",
        "indicator--f4995780-fa98-40f9-b48e-94349a4462a9",
        "indicator--449ea884-64e6-4635-9155-ce17c1651729",
        "indicator--2dda8d55-5f42-498f-a54c-4317718137d5",
        "indicator--5588bdf0-9910-4ee6-8320-a8198a4f3741",
        "indicator--2d2e2411-53c3-4561-9da1-7d162757677a",
        "indicator--e4854edc-2e95-4df7-bd47-96d2ddc5bd44",
        "indicator--b6cad070-d43e-49a5-b615-646c2bdc79aa",
        "indicator--ed0e4e90-ba02-428c-95f4-ec50312d7079",
        "indicator--933a3e65-41fa-44a6-ab81-608aa9764f7f",
        "indicator--dbb96c35-2d30-4a19-bac2-5443fb07ad4e",
        "indicator--662de756-dc76-464e-9dc6-362a2ff92871",
        "indicator--6536f679-c0c3-498d-a66e-6cef25f36e65",
        "indicator--42a6f29d-9b2e-4824-b167-9c49575c78f6",
        "indicator--2d3f45df-a61e-4fa2-8fa8-e8960dcaab1b",
        "indicator--256bffd8-3fb7-4009-bedc-d6124af85816",
        "indicator--11f08629-7428-4caa-95cf-5258a03d9ecb",
        "indicator--cc43a6bf-32f9-4eeb-b776-d860b2b1ca76",
        "indicator--c0dc5d02-e683-4250-a88e-0244c0a9ebd3",
        "indicator--4e46b47b-f645-4049-b265-e1b472786020",
        "indicator--45f7dc4b-c52e-4fc8-9a8e-b524ff66b782",
        "indicator--f12481a3-e44f-4f14-9363-d556a890660c",
        "indicator--a4baac67-01c2-4b1d-bceb-d351d1be31fd",
        "indicator--2bdea174-07ce-455b-a65b-9f1d85e28456",
        "indicator--10ef1baa-ee80-4730-88d2-dd78c1087b43",
        "indicator--b361146d-529f-4b72-b6d5-1aa8c078a49c",
        "indicator--282d472d-7081-4105-9ed9-fdbb73ec645b",
        "indicator--fbce2876-cb3d-4c63-a681-88682a0987e6",
        "indicator--f90dc26b-99b0-4335-9eaa-e6367028646b",
        "indicator--da83b464-2a67-41db-bfb0-76adb1027c6e",
        "indicator--5758bee0-4d12-424d-995b-f537f8807471",
        "indicator--cdc73429-8c8f-488e-9908-16f0296b0574",
        "indicator--c5b2de4e-b12f-46a8-a34d-f5a5cc07cc4a",
        "indicator--4c06cf14-8da9-4781-a14e-b2c2b98cc2e1",
        "indicator--63dced73-9b9f-4b2e-80ba-bf63ddcd8b31",
        "indicator--919b61de-7bd9-477f-be2e-df1b1d77f8b7",
        "indicator--37c0f460-42fc-4887-89c4-7e37d61343ae",
        "indicator--4eb59244-ad7b-4276-b9f7-1ffaee75e182",
        "indicator--f41b67e4-0775-4284-97c8-dd16a90826c4",
        "indicator--192477f9-56e9-4e8b-a2c1-f79a4cec0730",
        "indicator--f5eaa587-b392-4838-a933-d19cbbfc4224",
        "indicator--8fcd1c86-f770-4ca3-bbcf-f922b07bb371",
        "indicator--9beda0f2-2ad9-4c47-81ff-c71f16e280d3",
        "indicator--7a163de1-78da-4600-93de-af279289e45c",
        "indicator--2b851cbb-b0bf-427e-8353-9b2394a8c195",
        "indicator--34b29d51-a979-4145-a2db-122b2f80bfd3",
        "indicator--44a0728d-9343-4827-ad21-f520143763b3",
        "indicator--7168f0c5-dbcd-48b8-ab9d-1ba929024b14",
        "indicator--ca0de576-e949-4dec-aca9-5fbff5d312e3",
        "indicator--a89a0a3e-4286-4200-9b8d-f529b5b10e70",
        "indicator--341f6032-645c-460f-984a-2af3f4ae9c3f",
        "indicator--afb74f10-c6e0-47f4-a06d-029b39c70eaf",
        "indicator--431b9185-ffd1-4c75-b373-0283d6425511",
        "indicator--9115b390-35cc-40a9-b021-acdf738f363c",
        "indicator--3d3252e4-26e8-4999-a79c-8eeae2d7e5d5",
        "indicator--d515530a-4f77-4c44-a49d-f6b8ccb7d5b7",
        "indicator--5780fc38-dc4d-4f74-80df-c3e574767fdd",
        "indicator--10746048-2b09-43db-bdd6-8e422290ba77",
        "indicator--966b8d55-4bcd-4865-83dc-7e5a9f7e93d2",
        "indicator--72de38f1-167c-4d80-af5f-b0cd4133096f",
        "indicator--943d2f3e-b39c-4584-a762-e9622fc4fe9f",
        "indicator--f67ffd2c-ffcb-4c41-bc03-aaea1964effc",
        "indicator--a03b46d8-6b60-4b2b-b15a-df861958e97b",
        "indicator--06c9b94e-77c8-437e-b143-7d26f897d259",
        "indicator--a80181ed-e9dc-413b-a75a-fe51364656dd",
        "indicator--21f842af-b3a3-434a-b9b0-0afb66a123bd",
        "indicator--a15541db-e961-458e-aba1-b348be38c50e",
        "indicator--f28d4ab1-d795-4e5d-8ca6-109f5023f2e6",
        "indicator--5ffae159-67ed-4a2d-899e-bdb7f1050bb2",
        "indicator--2a01da51-d2ff-4704-8cd8-b8820cbeb9fe",
        "indicator--c842da96-ab42-494f-97db-0b46715a7e2f",
        "indicator--8d6cb90a-561e-4dad-873a-6b7ef768d103",
        "indicator--d5b9f5df-782f-426f-a587-077f98ae3b3b",
        "indicator--fafc868e-d0b3-4b51-85b7-ac1c433bc84e",
        "indicator--873c4dc2-d739-48cc-accb-186d318cf5a8",
        "indicator--dfb7b648-32bd-4dfa-80cf-ca98480f5822",
        "indicator--d28a106f-d97d-4fba-980b-945264a35911",
        "indicator--40efb009-4a71-4557-8a76-e63d20940b3c",
        "indicator--e70e019e-4043-4583-adce-17e3c0de3f9a",
        "indicator--87910225-e211-43d6-8e0f-36badf0a456e",
        "indicator--8974ae26-4c27-4b9c-9ba1-812ae390d665",
        "indicator--256f4ba8-786f-43dc-b140-fe498a6f2c68",
        "indicator--453c1c77-0d37-4a27-89a2-933db385c6a2",
        "indicator--1a321d9e-b534-484f-b4d2-b441185a7333",
        "indicator--7ea63083-fe67-4f80-9372-6a0f6fb74dcf",
        "indicator--d8a0b7af-6a92-4c65-ace7-98831d6df8dc",
        "indicator--6bcfb678-d402-4a1d-a2b6-b44170404cfc",
        "indicator--76561da7-cb95-4596-8922-af3d6276befa",
        "indicator--dee71225-569a-48d1-8cd7-636420ff3ccf",
        "indicator--08cd7a19-8624-4105-88ce-a6e1368f12ff",
        "indicator--4e1b9248-bddb-4114-a15e-1992677cfffa",
        "indicator--653ab9d8-7323-4360-b204-b60dd9acdd26",
        "indicator--fb739250-0b7b-446a-a1b1-726115d7d7ae",
        "indicator--2aa17a41-94e1-4d0c-813b-ad95f1e6a658",
        "indicator--57f0800f-810a-4829-8448-3257052b98f5",
        "indicator--144ad206-f5f0-4dd5-8029-7c5a2b8f111e",
        "indicator--a4783fb3-c137-4404-82bd-bd67c6780023",
        "indicator--f1381559-e52b-4710-b0c5-d53912475ca6",
        "indicator--28d65b6d-52b8-4d3e-b92e-f01f5cac77d2",
        "indicator--6ee978c9-b3da-4131-a807-a31bba0889da",
        "indicator--fe58d46a-1e64-4590-a8cf-2e74703b2a31",
        "indicator--2af28387-1132-430d-bc4c-929f1183c400",
        "indicator--6ee237cb-f224-4615-8fb5-43b4a44cb716",
        "indicator--765bf693-119f-4900-89ac-e6ff860f25d5",
        "indicator--810406a4-a521-4d26-99c3-15847a9bc5fd",
        "indicator--0ccc3d75-22ca-46a9-b9a5-d73239b301a8",
        "indicator--9bdd51c3-6012-4360-9533-0ec1f476871a",
        "indicator--faec446f-e73e-4e65-92b0-77ff9ebafd65",
        "indicator--a15850d6-8c8f-4225-8da9-f266761a446b",
        "indicator--bda317dd-29b5-4b52-aa15-d4faf86f291f",
        "indicator--7f7a25af-be17-49fe-9b9a-5683ab67f6bd",
        "indicator--6abf4c1d-8eb2-47ad-81dd-bcb2ba9e5d58",
        "indicator--65bc2448-8189-4ef3-a3df-c75b49fc9848",
        "indicator--d5465120-adfe-4abf-874e-8be98240cefc",
        "indicator--0506142a-55de-418f-a84a-5cb1686b5f50",
        "indicator--dac13386-c266-43d5-9bd5-0502d7c514e1",
        "indicator--5853b058-954c-4f93-af34-be7f0a1379cf",
        "indicator--f71f1702-6875-4c54-a776-3632c4fef98a",
        "indicator--72f5f799-77c8-43d3-ae96-4fb1494a07d3",
        "indicator--c8f217ae-b265-42c4-b9a6-f6d8f081a934",
        "indicator--1777a83b-5ec0-4ef7-a154-66bb8f070ad2",
        "indicator--e1df11e4-4d0b-4d3a-88aa-c20a18e30f48",
        "indicator--8df5af37-5eee-4764-add0-544dc9ab1988",
        "indicator--7e16a27f-e29a-4026-b2a4-4e33aea5ef5e",
        "indicator--a6a170ee-9931-46f2-95a4-40c0382b36e3",
        "indicator--60fa3c33-100d-47e8-a520-7e6aa7a4b007",
        "indicator--588705a4-11db-4903-95f7-b239aaa6d307",
        "indicator--03a657e1-84a2-4ef6-aeb7-b47d1890f246",
        "indicator--978255b1-864a-4d5d-bf57-97b0e22744a7",
        "indicator--5e08527d-0e7d-47fc-aafa-efaa5e5a12b7",
        "indicator--39304b36-677a-49a0-9b6b-6bacc7fbe534",
        "indicator--bb97fec4-4c4c-49e4-b4b9-5b561749e909",
        "indicator--2df27012-fdac-407d-a868-ef0f12991db2",
        "indicator--edbd0d4f-f6f2-4a8d-8cb6-7a87724fa014",
        "indicator--26d27c05-c8f1-4334-b6c9-a0ffba910759",
        "indicator--1c8b6b95-5ab0-4fff-8085-dc479e0f6f77",
        "indicator--fc0ceb03-47d4-4ae2-9b5b-6f58f110053c",
        "indicator--3462b620-a325-4579-b51d-38ca5b68f17e",
        "indicator--b75b876f-bdfa-4fa0-8019-ed9e32e32864",
        "indicator--e0d5ede3-d3d6-4aaa-ad8c-5b82365fe83b",
        "indicator--8dcddffa-36b7-4e61-8a47-dcaa0e3b9e39",
        "indicator--8000c483-2eb0-4bba-b621-405e43a605df",
        "indicator--5280637d-f44d-425e-a7a8-7a1a53451cc6",
        "indicator--4843d525-fcaf-43ec-a271-0f20ffb0c42f",
        "indicator--a956a6f7-ea2a-417e-b59d-d038c02e05fa",
        "indicator--51ecdc52-1328-49e1-9167-1db392e73a39",
        "indicator--48badde7-7e31-4d0c-b047-f2516fd432bc",
        "indicator--ff7c6c6c-6f15-4a73-b045-61340e4fc2b3",
        "indicator--fccb3f23-7a20-40c7-8585-34e46f4d39b3",
        "indicator--7ab4d906-b77a-45cf-874e-a5fb92ea0a85",
        "indicator--e6673fcf-523b-44c2-8c1a-dd484fc27c9c",
        "indicator--2ea0a2fb-2ec0-421c-a757-1bf2d83a82b8",
        "indicator--c9dcbb07-79f1-453d-8248-8d35904f64ad",
        "indicator--f40026ba-15d8-4d87-b0dd-146854b0209b",
        "indicator--2f2a96cf-84bd-4df4-bdf0-cf93c64f81dd",
        "indicator--947ef309-0ce3-45ce-8c76-9b1e1c07b727",
        "indicator--ad100906-6650-4d02-8058-ae0bbf769cc5",
        "indicator--27d0d07b-efce-4d5f-9197-ed61a33d1509",
        "indicator--6fe425a5-f90d-4d1e-a537-778ec3a9d290",
        "indicator--b4889467-5f9d-4eb8-9cbd-4083bce3b516",
        "indicator--262664e4-2d19-4164-8626-97fa8af55489",
        "indicator--e1e9da6f-1150-4a70-bc79-0e1ae7ddd52f",
        "indicator--8eee3341-81f3-4450-aa66-fddfe840d4a8",
        "indicator--57dcbdbc-3253-4e91-a224-8d807efbe42f",
        "indicator--7943bac2-06d5-418d-a7aa-1802e835f391",
        "indicator--89a0fbe0-efec-409f-b98b-efcd037b7c49",
        "indicator--865944c3-6098-410a-add2-345a2debd5ec",
        "indicator--94ffdcb5-1f89-46a6-a13e-923c4761db50",
        "indicator--ce68a723-072c-4c6c-9fa2-58d83d4c09c2",
        "indicator--9fcac7e4-bdaf-4d4e-acef-477230052070",
        "indicator--f2525f9f-a598-482f-851b-05e5928327f1",
        "indicator--f8956b90-5815-4dab-92c1-838d4ba79c00",
        "indicator--df2a58d0-186f-48e5-9681-61aa23f5e74c",
        "indicator--71f5e0a2-dfaa-45a0-9a6f-49244349dbf4",
        "indicator--b4a575ee-b702-47fc-92c7-4c1ee2f9a092",
        "indicator--8778c30b-79e8-4717-b8c8-41c64f3558d2",
        "indicator--509b0ccb-a518-41f4-b4c1-76a7ac44fa71",
        "indicator--b7acd9e4-906f-45aa-a4b4-d49690b4fd5d",
        "indicator--77e68797-9c44-402b-83c7-dbac3775e751",
        "indicator--53a03ca0-533e-4b09-97b6-902d116aace2",
        "indicator--0c7e9cea-0347-489f-860b-74dae074f7c7",
        "indicator--3fd7a356-c5b7-408c-92a1-7dbcfff0fa05",
        "indicator--54b92e74-b7e4-4e09-bdbb-8375e5ce717b",
        "indicator--9ab720a2-0e81-4f26-bd3b-0e093db9f6ee",
        "indicator--e63b0269-c525-4bdc-acc6-b9ee1f695482",
        "indicator--b57a84c7-b815-4c90-add5-d9bc20735584",
        "indicator--3c43ed44-ac38-4142-8826-5bc8dfeba74f",
        "indicator--13f04f0d-4e10-4b39-a8f2-e40e59fbe5c9",
        "indicator--97c6049f-633b-4d51-b972-4f8fbcfc74fb",
        "indicator--9719bb5a-4bc8-4719-a760-c28c8b10df33",
        "indicator--32bbdfa6-a96a-4407-8ece-b4beab06a336",
        "indicator--e5852b1d-6b82-4b5d-9536-36f061603ec4",
        "indicator--baa0659c-1658-4faf-9833-d606ad844fd4",
        "indicator--cfad93ba-67f3-4ce3-848a-612ca7fb145f",
        "indicator--35466c43-5ed7-4c06-861b-8ba998dcad78",
        "indicator--52d8d17e-a293-45ec-8943-d428297cf647",
        "indicator--b316c3a7-fd19-4715-90df-7f2089143fec",
        "indicator--7c1b62cd-86d8-4235-bac8-55b330a418c4",
        "indicator--667ac802-4f3d-4bca-8ec4-3b4698e7afcc",
        "indicator--e5df168c-ee0d-4e78-8b76-5945a1d04d0c",
        "indicator--0253a538-8ee0-40d5-906f-33dac56090b0",
        "indicator--6a4c9230-cc1e-41ca-abeb-6a925f5e6752",
        "indicator--8a113cf9-2977-4bf5-b4a7-7ce44c960efb",
        "indicator--d4cf5aed-a7b9-49ef-89f7-cbf6c3ac41fa",
        "indicator--40722c38-43c8-480e-8b07-7d1bca71447f",
        "indicator--554c0a04-3c09-40e1-8373-c05d96005b24",
        "indicator--7a89a6ec-24da-498e-abad-a9cf20b840c3",
        "indicator--dd544f1b-6b44-4179-9ef3-a9db99d8c2ea",
        "indicator--82c6706c-0c54-4538-99ab-bca4d9e48b72",
        "indicator--46df56a8-fc00-476f-abed-944e682dce4e",
        "indicator--30006ed8-fd23-4e85-9ecc-a4bc7804cf3c",
        "indicator--7e6f5ba8-5c72-46bf-bacb-c08197b72a3a",
        "indicator--259d3fe3-461d-4046-9c24-dc20adf37ebc",
        "indicator--4515dfa9-a9ee-46a6-aacc-9a41a2e1d47b",
        "indicator--f33883a1-bd69-49f4-9674-3da62e117bc3",
        "indicator--e6dd4e9d-46f0-4b7c-a6de-950eb249838b",
        "indicator--62115071-b040-4cd6-99eb-402e9e781e95",
        "indicator--c6b19e25-e3d7-4a8d-8c47-23c0d695d930",
        "indicator--cfdf302e-6d0a-4a41-b5ae-d2fa016cbdb3",
        "indicator--8fd5b17d-6cca-487d-989b-a91a9e7775bc",
        "indicator--f61f9e82-2cbd-4d23-8ae1-ce5c8211ff36",
        "indicator--54c5e73b-efee-46e0-8469-2105f4e1f6da",
        "indicator--7cd70405-0672-4690-9d7d-6fcf9511c009",
        "indicator--afde109f-b49e-4f3e-932c-70cbd22986bf",
        "indicator--be348985-8f5f-4c37-b6b7-6acc0ac69be7",
        "indicator--4be9893c-ff2f-4a2d-8e4d-8549e821930d",
        "indicator--778cd591-d0b2-4053-802a-34848da80296",
        "indicator--db1e4c83-21c2-4bf2-9853-e382a67f99b3",
        "indicator--f62bb967-284b-4b62-b89c-21a4336a9f12",
        "indicator--c0b1883c-29af-4019-a5f2-e8971e6db8fe",
        "indicator--6bc98b9d-fe97-468d-9243-054f21e9f539",
        "indicator--04895fbd-5d04-4b82-8698-745782f7767c",
        "indicator--f4f0ebad-4d0e-4286-b297-3a32142dc9da",
        "indicator--17f0557e-2305-4677-929d-05b8df41024a",
        "indicator--12eaf260-9f9e-44bb-81b2-7c0c4c0a9cbd",
        "indicator--d361a550-913b-477c-9225-d16a447aafc5",
        "indicator--930e6fde-d931-404d-a526-690edf3a7de4",
        "indicator--4db8e4db-4f66-43ea-8b64-0edb51194b67",
        "indicator--fcd9ba8d-19b2-48c0-a445-cb2e1377a7a1",
        "indicator--74c1076d-2db6-451c-b4db-66027bf69595",
        "indicator--fd945581-3757-46a2-9e58-db0b88d8e790",
        "indicator--f153be6d-43e9-4dad-964e-a50645ee2578",
        "indicator--c0a1f273-5977-4010-9956-3ce73081e366",
        "indicator--1c778c44-03cb-4009-806e-5e95cdc84cbe",
        "indicator--f0912112-b13a-4795-93f0-3949ae5c98e8",
        "indicator--a900aceb-7be8-4091-8f90-dc366247d001",
        "indicator--e02fff28-acd8-40b6-a647-927d62f03de3",
        "indicator--fe32dbe6-6b0c-44f3-b9ee-add7014e8d98",
        "indicator--deaf41b8-ad19-4c84-93ad-220c0704b6a3",
        "indicator--16f6efcf-59a3-42c8-b1ed-ed3f949f4c3d",
        "indicator--08aa3dd5-5ef9-49d4-8833-9b1588271fda",
        "indicator--0cd5a71e-36bc-46cb-aae6-f7620d6c48b8",
        "indicator--4052e8b2-1350-46d0-a683-6e0daaee6a36",
        "indicator--f4d96faf-a4cf-4db6-97f1-d8fdc62bf3a8",
        "indicator--a618f563-3e40-4831-b4d7-09d9c0e3b805",
        "indicator--495e4692-5043-4b44-a343-2eabc6f48026",
        "indicator--6220f191-542b-4474-b489-1ea33f6de62a",
        "indicator--d49f3bd3-ca05-405d-ae1c-ba867df1560e",
        "indicator--6678ee79-6a8c-4669-9096-83a1ab858198",
        "indicator--88e9aa8c-5443-4513-8fdd-10564d6652c5",
        "indicator--ec1ef34c-2bd3-4d4e-96e4-364bbf90afdc",
        "indicator--261da30c-84e0-4f21-ab04-7d2871921778",
        "indicator--15d786a1-b30c-44d0-8db6-b0517ef1da37",
        "indicator--0d15620e-d0f9-4a3f-a3ef-26b2fa33a75d",
        "indicator--3e1ea4cd-1a34-4f78-948e-c2fd8b24eb69",
        "indicator--5bdc6387-dc91-4123-b443-6814779a77c6",
        "indicator--de42fff2-76c8-4dad-876f-1ad35b8a80cc",
        "indicator--07f4c969-98be-4f62-bb7c-c04e7403d635",
        "indicator--e920171c-d429-47e8-92e8-9922d00475be",
        "indicator--5b3bf0c3-91cf-4cf5-bf81-a08a11be79db",
        "indicator--a4910374-7ae1-43f9-9e24-233e9a3e71fa",
        "indicator--2f01a3fd-3ed1-4896-a75f-008f77ed7e51",
        "indicator--89d8a47c-82f8-4e18-99f1-c2305aca2cc8",
        "indicator--330f320b-4f3c-48ba-9e6e-b15f4095b47a",
        "indicator--35a4de61-95fe-4ced-8551-f48e3b0c5ed3",
        "indicator--ad8923ea-22c6-4df2-992b-12005660ce5e",
        "indicator--5f198d84-0c1e-4750-9212-629de4a63067",
        "indicator--37829298-9dad-4adc-bf3e-0a8a43308c43",
        "indicator--eecf8e90-1558-4735-9cf8-a7231107343b",
        "indicator--c56c651d-fbc7-4369-8be5-c5a178a74944",
        "indicator--2122837a-2e82-43b9-b2f4-86012a485028",
        "indicator--2ed3ed07-c19e-40eb-8e47-0ce2d82ad92f",
        "indicator--97a44429-7642-4467-9bc7-8117049e9a8b",
        "indicator--41be4700-30c9-4139-83cc-148f222bb087",
        "indicator--e355d301-9442-4e6b-bb36-59a3cc28e065",
        "indicator--77866f86-b553-4864-9d8e-caa1f1848b10",
        "indicator--1f6c434f-5408-40a0-a1a5-063be89d728e",
        "indicator--efaf1dc1-0a30-4296-8394-918dc5a23df5",
        "indicator--ca7e281d-9863-4bbf-888f-a29d764ad697",
        "indicator--7e16542a-fa6b-4953-b001-a381e47c7c25",
        "indicator--f0577243-9763-452f-b40d-f654fad67f61",
        "indicator--5e3141a5-0543-47f6-8fdd-74a0cad77599",
        "indicator--2cf091b7-1937-467e-ab0e-7688b9992b3a",
        "indicator--8cbe76d0-2b5d-4034-b4d2-7b021a9e2aac",
        "indicator--c8eeb4c5-3cb1-488d-99ea-9ed61f274c04",
        "indicator--67d229f0-0bc1-43c4-95a7-ff0be8b306b8",
        "indicator--ec6fb90d-ec91-43b0-9143-b816fc7b95e9",
        "indicator--3848a762-7f7d-4f2e-ba5c-d9cb4b853a14",
        "indicator--9d0572fe-0ea7-41dc-8207-f3f6048bca1b",
        "indicator--2ff2b71c-8717-4d59-8763-3e97c67b279a",
        "indicator--80c1baac-a607-46b6-9af5-5dbe6a9da325",
        "indicator--be2d1787-e806-49f1-b370-fe52c3cfefe3",
        "indicator--7a43ac8f-d938-4e4b-bcac-f173476151c6",
        "indicator--566d92f6-1198-4f93-92d1-4492949e2b2b",
        "indicator--478bab72-5ade-44c7-8221-97c4557d7611",
        "indicator--8062c84b-7b4c-4744-84f3-5431162b80bf",
        "indicator--3480c8a0-92bd-4db0-80fb-b8a0ea50cad7",
        "indicator--bbe494ae-b47d-4ab8-85ee-6e713bd63203",
        "indicator--c87d060d-0652-4823-8e63-418dc0c2dcba",
        "indicator--84233b09-9b4f-4769-a8f9-dff91b98e7e8",
        "indicator--584f033b-0f84-4b1d-b9be-a87c6edbb86b",
        "indicator--ed338e9b-213e-4615-8208-5d970da1b294",
        "indicator--ffa2558a-5fc1-49a5-82d9-dce38237a61f",
        "indicator--2cad1e8e-d6c1-4405-87f0-fefd0c342dcc",
        "indicator--b69a7a6e-80a4-4ae5-abbb-9a6c226053ad",
        "indicator--47c9256d-fb4b-4bee-bf41-d2c1b12e0a98",
        "indicator--830c0ca1-afa9-444a-8bce-7dd14c529276",
        "indicator--65ddd3bb-5c69-4d32-8dad-d3889ed931c5",
        "indicator--15ebedc5-67bf-483a-b9fe-b132d32f7ebe",
        "indicator--4dbcc8e3-a6b8-4bfb-a7df-77516d36d539",
        "indicator--dc293e99-bd08-490a-bbc7-fb01bffe6735",
        "indicator--613a5a70-b58c-4ad4-b683-29cb42d00932",
        "indicator--f5aa8e3f-b6f8-408b-8e01-3911d61ca4dd",
        "indicator--b8ca905f-71ff-49ca-84af-990fddb7a75a",
        "indicator--5d3cc13a-5dcc-46d5-aead-f966ab01025b",
        "indicator--21214d56-f488-479d-bd4f-5104d5fc8289",
        "indicator--b7734e8e-6e29-4e33-91a0-edef25d78e7a",
        "indicator--6679a0a6-2ed3-465f-826c-4f8faab2c4bf",
        "indicator--75a6bb3d-6610-4ef3-8241-3471097d5398",
        "indicator--2e6d4418-65f5-4c7d-bc53-04e43e36154d",
        "indicator--30e13408-4fe1-4e4c-bdda-57af9c02b497",
        "indicator--e5bb603e-1542-4bfa-ba32-91397d721e81",
        "indicator--cf0af588-32b7-4293-ac29-f244792bb96d",
        "indicator--c2b4c59b-c3cb-4df3-99fe-f644e255293d",
        "indicator--4ff7d8f2-e861-44a9-98a6-b36ae5ddb8f9",
        "indicator--c3142f83-ccae-4f0a-95a9-a946df50a7ab",
        "indicator--630dd591-20b2-467b-99fd-3887b9fabc13",
        "indicator--d9eac281-71a0-4f95-88e4-f0165f4d4278",
        "indicator--b37642d3-ecbb-48c2-8646-365c3b2a4dee",
        "indicator--657be241-58a6-49c3-bdcd-bff4ea43dce9",
        "indicator--067a6e9e-9f53-43bd-8c63-2b8e757bd4ae",
        "indicator--5648de06-4687-45f6-8706-e1abe04abc12",
        "indicator--ac5dec64-5fae-43bf-ad0a-d5b235dcb169",
        "indicator--bccb7afc-f0db-43ca-a7ca-18525fb73a25",
        "indicator--51384afc-78ea-4169-8b17-74346f420fc5",
        "indicator--7e1e06b3-9566-4beb-8c9e-b32ffcb7a55b",
        "indicator--85c229dc-a6fe-4c7c-8914-eb7d8dfab029",
        "indicator--716afbda-671a-43f7-95ce-68e3b065c54a",
        "indicator--829191e5-fd48-4009-9de3-0d1ffbb6d11d",
        "indicator--544a8398-86cf-44ac-a669-f9cb956425d2",
        "indicator--e8eb0db8-9970-48dd-84e9-ff49b232f76a",
        "indicator--893e1103-7d0b-439e-a89f-6a60e7559db9",
        "indicator--daa9a3c5-f3ad-4b7d-b3de-8dfe0a2b5be5",
        "indicator--41410656-3e25-479e-ad3b-55b19e4e5996",
        "indicator--e7d99d17-2809-4aa4-b36f-6964e18e3bd7",
        "indicator--f0df9278-d605-4a87-be59-567ad0776013",
        "indicator--d2c72d93-36a0-43e6-8c78-81a428fa8d78",
        "indicator--8eecf478-1103-42c1-9caf-46013778d802",
        "indicator--2e20e28a-9c92-4758-a4e4-eac8d68595e7",
        "indicator--01855052-601a-4625-b875-ed44080e3194",
        "indicator--e02ed460-05cc-4184-b791-b2026c08832a",
        "indicator--62526437-6189-4345-8f18-11d3a2ff1f9a",
        "indicator--b85cc997-bca1-48f3-b3c2-9e5894b315eb",
        "indicator--cd858af1-4bba-41b6-9637-ad7d4d0decc5",
        "indicator--b3ab6d9b-4400-4afd-98ab-09c70bf29805",
        "indicator--bf1631e1-b8c1-4acf-a61b-8279c62654f4",
        "indicator--738acdad-518b-416f-bf42-c17e758a94f0",
        "indicator--038753e5-2675-42a7-b8a3-f05cf6ab2cae",
        "indicator--e7a22934-0f24-4ef9-85ac-2264e8ef84eb",
        "indicator--4c4721e2-33c9-42f7-a573-47989e468cfb",
        "indicator--6d18f78a-3b44-40bd-98ef-30a5b172f26f",
        "indicator--fe282b66-fd23-4124-bb76-97daf36f2328",
        "indicator--4603954a-0eeb-4975-b5f7-78d3aef7dfba",
        "indicator--db1329b7-2e14-4a8e-a68a-c60ba5107d00",
        "indicator--91905208-261b-42fa-ac87-fb419adb9dc1",
        "indicator--4528c8fa-2393-4efd-8d36-dbf345e640af",
        "indicator--c82c5654-6a28-426b-a9cf-5c24e5b02a5b",
        "indicator--d7e931f1-ecc2-4f5c-9d77-356ce2f56205",
        "indicator--ed89394f-a113-4770-aa6c-c6452a3f45c5",
        "indicator--f49f35e0-6921-4138-8a7d-b40a55d9cbcc",
        "indicator--ffb4005d-b39f-442f-8390-f9a357c6cc46",
        "indicator--14d8f6bd-57df-4f5d-a387-3398250363ff",
        "indicator--e062c3b8-747b-44db-a625-e9122236d8bd",
        "indicator--d6b4427e-edff-41f2-879e-c3834e1e9bf8",
        "indicator--4403499d-ce52-4286-bd20-e5b1cd508db0",
        "indicator--8c69ec80-389c-46ac-bbf4-ab3c67b19e7c",
        "indicator--7eed4ba1-6f09-4535-89f5-f2dde638edac",
        "indicator--23e596c0-3ff5-413e-a1df-eebc2dfc223d",
        "indicator--4135f321-6d04-486c-b9cb-a4802d7d38de",
        "indicator--aed061ae-3f1f-4005-b0e6-8e9d4072e1af",
        "indicator--b3c83928-f38e-4dd4-a0b4-d93793c398e2",
        "indicator--50d8f799-efb9-4969-8cc1-5b3c0b7f3ac9",
        "indicator--c8896f87-5745-457d-9ad1-ae5718fee0c6",
        "indicator--9b189d53-10c7-424e-9a81-bf898cd4e143",
        "indicator--264e4082-4d62-4bd6-9e14-0540fffccb12",
        "indicator--8f2173d3-f979-4666-977e-bb0667cfa48a",
        "indicator--12b69f74-cc69-499e-930c-64f44e7df166",
        "indicator--0a704eea-0d10-47fd-a03a-dae52d174481",
        "indicator--cbc67404-e744-404b-aa62-ce19b895e6da",
        "indicator--cd06d881-b09c-4f08-9f53-7d64a3b8af51",
        "indicator--19a91643-038a-4380-884b-5b6f33c7a326",
        "indicator--eb308426-22db-4997-a6f2-191bd0551347",
        "indicator--3678de49-0d4d-42c3-8181-b4378f681a79",
        "indicator--fb7c450c-3ce4-4969-893d-803135f254cb",
        "indicator--40bd01e0-afa7-42de-ad06-fdc26292a817",
        "indicator--a61a5b9b-7035-48f0-b2f2-afd262f2a476",
        "indicator--ecd124ed-a608-477c-bba8-12f8918d0191",
        "indicator--f91512b7-4c6b-4650-acb5-7fec31fcb4d5",
        "indicator--13172bee-954f-427a-8bd3-049ecfa21dfd",
        "indicator--67cbf654-8ac3-4bf0-a194-c6a0236ce9d6",
        "indicator--e83786e5-2a03-40aa-9353-8c0826c64b7d",
        "indicator--6d6684e5-9cda-4716-99a8-33a74765e8e6",
        "indicator--f10cbed5-d0ed-4ada-90a3-e8d99d3c5404",
        "indicator--53d17ed0-bea3-43a7-acc7-c51f9191933a",
        "indicator--203ae300-8c03-492b-92b1-3c1ccc48fd65",
        "indicator--0e00f9da-ae75-4869-8c52-eff9e6416a59",
        "indicator--5707eac2-920a-4878-b6ee-4f3c1da92462",
        "indicator--3c182840-f9d4-4d39-bdf0-decad978921d",
        "indicator--96c79e95-37ce-4b27-881e-c8f1ce392f30",
        "indicator--6a4c8379-85e8-4a2f-8754-13d3be5ec18d",
        "indicator--9ae8e8e2-e817-4b11-8f1d-28b407a6e4e0",
        "indicator--8cfa98f0-413b-4b09-bf8a-f497b1017bd2",
        "indicator--ff9ab470-740c-49a1-80e0-e62712c1e3b9",
        "indicator--d34049a2-d19c-457a-afd9-f2c74c65b975",
        "indicator--862e4ce1-f825-44c8-ab48-c70fdc504820",
        "indicator--032578bc-df4e-45c3-a403-f8d0882bee16",
        "indicator--9726c8f5-1a13-40ed-986d-fed588a0d099",
        "indicator--c2d7370b-ff37-4079-b44b-f942c85e5a03",
        "indicator--93a1c5f3-25f3-4a04-a665-53579fc27577",
        "indicator--c5d9027a-28de-4a83-ba19-e4cfd90681ab",
        "indicator--4da362df-5a80-4d30-b6fe-f23ab2dcde4f",
        "indicator--25bb8803-839a-4224-9b1a-8056aed16be8",
        "indicator--cc58c595-e6a1-4507-9e17-6e9ec82cdc93",
        "indicator--22365f69-1d12-48f5-ada1-099ff02833b7",
        "indicator--8dad4109-4a58-4fd8-b61c-b863b34d0373",
        "indicator--454cea9a-3d86-4097-96e6-97a9db62cff1",
        "indicator--ca275b47-1c30-43ce-ae88-960d62e31616",
        "indicator--4ea9d4b7-18b4-45e1-8264-8fa38306a1fd",
        "indicator--d66c4970-9e28-459b-a9c8-bc1b15f277de",
        "indicator--c4a03e1b-750e-4f13-8e74-a80ff242144a",
        "indicator--dd361783-959a-4618-9b54-98871cbb828a",
        "indicator--807ce508-98da-4f29-9dee-aead1c4e0882",
        "indicator--44e169d3-7c63-4dcf-b5c2-f149bf99dccc",
        "indicator--6ed0b03f-9f13-40e2-90f1-21a17e0fd3f9",
        "indicator--fd175d29-7cf8-46e7-910f-0ca7209ba448",
        "indicator--48861b80-2455-458f-81ff-c2946c953bfd",
        "indicator--0727c00a-7ac3-4d3c-af6d-c2a51c395487",
        "indicator--b9c21eeb-b5ca-4bfc-a761-28211ad20058",
        "indicator--3b6853a3-2809-4411-9201-484ca36ac8ff",
        "indicator--a66b6dbb-7a7f-4ea5-babe-ea42e39ed2ac",
        "indicator--6cd046dc-bc0a-4d4e-82a2-33ca6861923b",
        "indicator--a862bd4e-6565-4dfb-822d-5055275c86c9",
        "indicator--2a1b6318-1d31-4355-8d12-1959b9c51f79",
        "indicator--427aca0b-6ce5-4c74-8e16-d740338fe8b9",
        "indicator--fcffa55b-f9fc-4d0e-af0c-2b1b703dbc09",
        "indicator--8eb2264c-3b5c-424a-bfda-7f81cfecb89f",
        "indicator--0d5389df-6292-4369-a4eb-14062f5e6478",
        "indicator--cc15a2a0-e7d0-4958-93fd-5109b8ef3183",
        "indicator--5badeb8d-922a-4c3e-b14a-b46cae8ea2a7",
        "indicator--a392520f-5ab5-4858-bf71-7a186c5a34df",
        "indicator--f83b8802-eb7f-4326-be87-510aee4963fa",
        "indicator--775d5014-4ef4-467c-917b-486faf1085ea",
        "indicator--054fe566-d125-4b8a-8fb1-e34e50acbc4f",
        "indicator--14656e7d-a050-459c-b53c-fbb103977f3c",
        "indicator--fa56ba50-6a05-43dc-9b64-1fb8621cb488",
        "indicator--4a16580f-1cd8-4b29-ac2c-c385f827e070",
        "indicator--ef768eaf-2b17-4307-8a1f-e8c7cd3c1f58",
        "indicator--42cabd17-944d-4c43-afa2-fab9f419e27a",
        "indicator--9cc4beb9-0a62-4e27-8e65-07a4e65df157",
        "indicator--b7c75101-9c5e-4ca1-be10-fc2cb1fb984a",
        "indicator--843e48b7-eca7-4170-94eb-61ba2a17f144",
        "indicator--29ffa2c7-99cc-4f30-a491-ea34a082a7ac",
        "indicator--75dff00f-72c4-44d7-9887-7228de34b441",
        "indicator--f05a94e1-d99c-4837-895c-c11409e85917",
        "indicator--aacdff97-bd53-4bd8-96a3-ff2d8f272549",
        "indicator--9a066d45-81a5-426e-93cd-60a71731790b",
        "indicator--2ec7e17b-3a96-4e67-8458-3fcc42ecf778",
        "indicator--55a96ce6-beee-4af2-9679-a4b95c2d0183",
        "indicator--17e1fa2f-36b0-460b-ada1-fe74eccf0a93",
        "indicator--4e30afc1-82c2-478e-ac8c-917f8e91f977",
        "indicator--2d1b2fd1-c765-4aee-b9e4-ad51a82d394f",
        "indicator--9b827778-fd56-4b6e-8c57-45aa88396c28",
        "indicator--05678bc0-3cb5-4f1d-ace2-6f6aca45cbd6",
        "indicator--95e132dc-a777-46da-bfb1-662341a5408b",
        "indicator--677efede-348a-4d57-9430-37206c4360b3",
        "indicator--60f1c35e-b540-475a-8030-bc5354a88165",
        "indicator--3c6675ed-ed5a-4883-a5c1-b2cf7de786ad",
        "indicator--505e3d39-98d6-4ff7-91f6-1ded54c8dcd4",
        "indicator--b670054a-aa88-4967-a59a-4c398f668ef2",
        "indicator--32d596f1-beb3-49b2-8155-1abf97fdb9a0",
        "indicator--56be2a38-0f04-459d-b200-f3c89735f341",
        "indicator--556d9df0-c828-4468-b02d-f0dc58d62e02",
        "indicator--ce50873a-c83a-48f1-8ed7-3cb1c101b138",
        "indicator--34c75046-01b0-4738-bc36-de8b477d84e7",
        "indicator--00f0aefe-5813-457e-9166-c8e483c5d346",
        "indicator--25ee153d-78b4-45b9-b54a-cd7a23fddcc0",
        "indicator--d4da6fde-3d0b-4975-a625-eacab734b7ce",
        "indicator--dd000465-098c-4e1f-aa4f-ac4bf841934e",
        "indicator--347afb2e-2ca2-4ff0-a5a2-7904c03e87fa",
        "indicator--ffbddc7c-463d-4c1c-974c-e3e2a5bc1e9e",
        "indicator--1818be5e-6ee9-4543-b501-e67562a729d3",
        "indicator--ec8a9e41-9f45-4cfc-b1b7-681ec3d15860",
        "indicator--7d377912-d211-4ed5-991e-eb1270b01c8a",
        "indicator--8e78560e-fa96-48b8-92d3-64557c1112f1",
        "indicator--b3a7a6d5-c580-4dd5-8dd2-ed4bc104ab86",
        "indicator--b6de054d-6c94-43fe-a756-f437a2a00b6c",
        "indicator--1583c68d-a25d-47eb-8a03-39b7e69b70c1",
        "indicator--c7bdaac8-11f6-47d2-a46a-7f56f49c8487",
        "indicator--3b395047-d954-4ba9-8534-9e638c0c301d",
        "indicator--6aca70a6-537f-45ae-a521-0bb2327c7072",
        "indicator--1a115460-13ea-49a6-a631-d38c19f6b640",
        "indicator--0071acab-651f-4659-a6b5-9ad6759747ab",
        "indicator--85f5f081-eba4-4b50-9651-df11efd8a525",
        "indicator--efdf506b-cad5-46bd-bd5c-23e77e4432e6",
        "indicator--51bd0d6a-3006-4eb1-bf41-40db9b00778c",
        "indicator--39a5280f-285b-483e-b9f4-336f25b631c3",
        "indicator--e59e9170-ff09-4546-9c92-3f99fcc30243",
        "indicator--f40fcd60-e4ae-4d2d-8ba9-d385d3fb2f39",
        "indicator--8eeba970-f47b-4c1a-b62c-c02bacced392",
        "indicator--3fbd9ed1-d82d-44bf-a1f5-2de9d2e86401",
        "indicator--653b4f80-1c22-4f40-ab13-96828d97f686",
        "indicator--e9c2c1c7-f784-425b-ba24-93d31c38d011",
        "indicator--b16eb366-7d07-42ac-a50f-b2f526dbfd0a",
        "indicator--817d15e6-f492-4089-aa82-851062c9e2a9",
        "indicator--b4059861-b149-41a4-b4aa-64f90027a1f7",
        "indicator--88be0642-3009-4ed9-b6f3-6c305c19f7cc",
        "indicator--f7991d3e-36fa-4d96-a156-dc192e2fb66b",
        "indicator--675724a0-d86a-4aa0-8f22-1de40a0c191f",
        "indicator--00abe1fb-a476-451d-9c8c-d6c691d41e10",
        "indicator--2f0dbbbc-0c4a-46ae-bb0c-c4f4d8071f7f",
        "indicator--1a4f22eb-3449-4644-aa01-6e136e3e14bc",
        "indicator--31602809-4f57-49d1-835b-c4cb3de999e4",
        "indicator--71df28b9-7198-4873-9323-82b5423ec959",
        "indicator--179489e3-a686-4b27-bb6d-30f5fc287042",
        "indicator--4fdc6d9a-9e3e-4ccc-9ed4-29a0faa1bb7c",
        "indicator--c33fd94b-24b0-4380-9ec9-cb0927367c3c",
        "indicator--4c3c4050-07ec-4729-bd12-6cfc074a1a17",
        "indicator--2f9ab8a7-6cc5-4e0b-8e21-16344b8b0dab",
        "indicator--fbf319e9-c5a8-4588-94c9-1eb3cecda3eb",
        "indicator--bfd4ce11-9cdf-46bc-a1f2-e2b9a447f73d",
        "indicator--4e259ff1-4ef1-42a5-b445-9f44f0dfc245",
        "indicator--42f864af-10b5-4ee6-a464-d599e56a96d0",
        "indicator--11c7e96a-5864-4a7f-a048-95c8eaa92d14",
        "indicator--42c49b1e-84b8-482c-9459-dde6136df507",
        "indicator--45f18fea-60e6-4248-9aea-b584b4816319",
        "indicator--bb30ac73-1c7f-4294-955d-34d93cc54ff0",
        "indicator--18e9fe9b-a5ea-4b0d-acc9-6fe3fbcc385d",
        "indicator--f1c8a72b-df47-46c8-b945-c8944eae3a33",
        "indicator--4b491305-5ec5-4610-91dc-5d5af5523af7",
        "indicator--8ad4b8f6-cbe9-4cab-a721-4bee72ec1068",
        "indicator--0566bbe9-da0a-4c85-95f8-d224f83debbe",
        "indicator--2c7786b8-ebac-482b-8153-b4fe6bda475b",
        "indicator--40a6c8a8-1234-4143-a5b7-ebe559e1ea55",
        "indicator--4c1378f5-e430-494b-b40a-86e0e9e5463a",
        "indicator--9226a66c-397b-415e-bfff-c36bed92b0df",
        "indicator--9a5a67b6-68a9-474c-bbdf-e5ca03303cfb",
        "indicator--090915bd-156f-49f9-987b-e2b0d93c666b",
        "indicator--89bba386-bd7f-4816-895b-ee823d1c8329",
        "indicator--994b6c50-b956-4c8c-aab5-b6b6b588c204",
        "indicator--84a6f364-ce1d-4da7-b8db-05934c30ab47",
        "indicator--bed6834a-8c95-4657-bb76-c81d855ead01",
        "indicator--96d51bc3-c04f-4980-9730-936a7273149c",
        "indicator--5fa95662-9df4-4219-8554-587906be5c10",
        "indicator--0b24f92f-8351-4e3a-89e7-020e1e4c9363",
        "indicator--def9891e-98c7-40be-9a6b-97b4651e252a",
        "indicator--23b6403f-6741-46f0-9590-ca362e7e67bc",
        "indicator--d33a0d3a-ca4f-48b5-bb16-26dcb10eaa8f",
        "indicator--3403d14d-9599-4bcc-be63-a26dd910b102",
        "indicator--609281d0-12b3-46df-a80a-1d40a8680dc1",
        "indicator--7bb558a1-b9a9-4f84-ba46-34daa3cb0cb7",
        "indicator--f217f836-67cd-4571-8cb4-3716e5930880",
        "indicator--995b102a-0b39-4b4f-bd88-6174fc74caae",
        "indicator--dc0ff5d4-ea60-4603-9784-80d8d18efe1a",
        "indicator--2e73308b-4711-4551-94a3-71abef6a6a20",
        "indicator--8b439d43-994a-485c-a1a8-ea03283015e6",
        "indicator--84c1d824-d63c-41eb-a989-949fb6e5c381",
        "indicator--b3e5d837-a24f-41cc-ac62-cfe04683bb18",
        "indicator--228b7fb5-9f6e-461a-b30d-0f8cd6a76b64",
        "indicator--df7a6a52-9c57-44c9-8899-b975337ae426",
        "indicator--3a3ea046-a7f7-4b0a-8750-25d0553eed73",
        "indicator--3e2d15dc-816e-48fc-ba59-aa68278b612a",
        "indicator--24c788f4-e64f-4583-aede-f4acbab54304",
        "indicator--9e9e6bcf-8c2a-4499-8c37-004323218271",
        "indicator--257ddb82-7ea2-46aa-8fa4-fa42ccf443c4",
        "indicator--18583404-6cf6-4a30-a7b7-340968354727",
        "indicator--fb4f92f3-0c2f-45b5-8235-3a81fff0631b",
        "indicator--1d8fc362-08a9-4969-b967-8fb71a30a12f",
        "indicator--28dbb92c-00b2-495e-817c-14d3eaa5bbeb",
        "indicator--0ecd7514-e6d1-42f1-a7db-f7da45ec0b45",
        "indicator--34344c3b-1cb6-432e-b47b-3500cadb7322",
        "indicator--7bb2270d-b2d2-4362-ac4d-de9775a98584",
        "indicator--17cff500-b319-4a54-aa05-81d92cf680e5",
        "indicator--37a9df55-5e14-4c16-8a6e-f538dd931289",
        "indicator--0c7990ee-1ec1-486f-92a8-5cd6edbbe72a",
        "indicator--832e0197-ffb0-499b-9672-d31f01d28d5c",
        "indicator--fd9d5559-f9fc-4129-97b3-3ce9b71854bc",
        "indicator--30b93899-f06b-4ff4-a53d-453a797b64fe",
        "indicator--c9505ccd-2729-468c-b079-3e997ed5a662",
        "indicator--be80cae7-6ae8-4fb7-b2a0-809f203f4b97",
        "indicator--1a4ede26-6870-4437-b637-daafdb82557e",
        "indicator--5377fc45-f076-4cfd-9f90-cac5a01abed8",
        "indicator--e3c2defb-2fce-438b-8e33-4d43ba6ca84f",
        "indicator--28f6bf11-b031-4190-9a2b-551cd8d4f11e",
        "indicator--b4f1c366-3744-4c93-8373-5e1a6d45ae19",
        "indicator--74881bf5-2472-4c71-acb6-d54eb955ee03",
        "indicator--90215471-9dfa-47aa-9830-890085aabe4a",
        "indicator--95922197-b292-4928-aed2-9c2e3b495108",
        "indicator--92e7b3ed-653c-4217-88ce-477c29a7caf5",
        "indicator--f9b49ca2-0486-4d62-ae97-1575b41e65b1",
        "indicator--099e1c1c-df05-4a9e-8a59-99cdae66e6cd",
        "indicator--e75a56fb-7724-41e4-924f-8f5c369ba11e",
        "indicator--3f3994f0-53f4-437b-b547-3beef4c8a82d",
        "indicator--0523467f-1049-4749-b522-218d32a1a299",
        "indicator--3285a80a-240e-459c-9c23-4acfd5107aa3",
        "indicator--e2279554-6d61-4a3a-a615-90ead5d02040",
        "indicator--d14e47c2-9203-4b88-99b9-210cfe5ae7a1",
        "indicator--f8639441-5581-4f90-9b1a-46ddfbb9b136",
        "indicator--ec7a58f9-7eb0-4118-8b33-f3d1107ca820",
        "indicator--7c11eebf-21a2-433d-8ebe-6c3cae7927e3",
        "indicator--b33add81-207a-46f6-92f7-21a9b4676226",
        "indicator--79bdc375-c50b-4772-be0a-96ea975b921c",
        "indicator--5cb7390c-0289-4f71-8ffa-6a4352e9a519",
        "indicator--7fbad40b-b00a-4f20-aff5-b05154dce8f8",
        "indicator--3fd075a7-9ac8-4fc7-8a85-be1d33e855f8",
        "indicator--80633887-0ef6-46c7-acbd-b3337b80a45e",
        "indicator--d1f65ef0-7308-41b1-8140-68eeba7d9f1f",
        "indicator--2819bfde-faf7-4e1d-bff4-28b4d10455c7",
        "indicator--3c2b1815-ae35-4481-a156-44354210ea0a",
        "indicator--57c50e01-0711-48a0-9236-921ac9cf673c",
        "indicator--eb22821b-3c61-4380-ac88-60144b32fed6",
        "indicator--ff02caf9-ac00-468c-881f-ed3227f118f0",
        "indicator--ffc4d498-4260-4ff5-a2fd-ca8714813967",
        "indicator--80b39899-cd06-47de-a783-ccf66509ee11",
        "indicator--3b10489e-34bb-48bb-877a-2c43a97c3e6f",
        "indicator--220f2897-c1b4-4e7e-9105-6d65cd883dee",
        "indicator--0697e1b9-ce52-4ae6-b703-a9dcfa7e5f75",
        "indicator--f11e5fce-0e4e-4d86-b37a-4176417ad6ca",
        "indicator--8f101f7e-442c-450c-96ad-8d41309d0bde",
        "indicator--e5b64017-e0d2-4f8b-be6b-43d6220abf55",
        "indicator--76d16c67-87d9-4520-8041-4680150cf303",
        "indicator--a930d525-ba1a-485a-bd44-b4bb41ff3991",
        "indicator--b19e72d6-9a70-4dca-8ed9-58c4ee361fa3",
        "indicator--a653049e-e23e-4668-bb4c-861691a6e4b5",
        "indicator--3481f82f-0002-4499-acf9-e7654e0991d1",
        "indicator--5bb0d155-1e8a-4bcb-9746-0bca0438dd5d",
        "indicator--47289d23-f5fd-4328-b6ba-a1baa23ebe02",
        "indicator--e9297c02-a45b-4c2a-9ba6-642c98b2619d",
        "indicator--8486a3e4-01f5-4ed5-9d4c-eb9911aa4c9d",
        "indicator--fd087a49-401a-47ff-940a-8de8bd2c52f3",
        "indicator--0c570b6b-35e8-46b7-aeed-5cb6338f5778",
        "indicator--0ee4c896-6167-4e9d-8217-71f068b38751",
        "indicator--71133ec2-5cbe-4c12-930e-05efcccfe0c2",
        "indicator--46fb3d34-342b-40d0-aceb-c87e5ce325b5",
        "indicator--ec0ee394-b2d7-4d33-a4dc-6f6eda17536f",
        "indicator--a66a1daf-8c91-4512-a98a-cbd356ceba69",
        "indicator--666da0bb-cc7d-4041-b994-70b321ccb1cd",
        "indicator--5fa29840-df92-4fff-83fa-af197bd68ba8",
        "indicator--46588858-8f40-46d6-b657-44b6d7e901e9",
        "indicator--725103a3-8c88-461a-a2b2-d81f8e15f6f4",
        "indicator--9b6f6943-9bb4-46c0-ae66-20b8b2dafc7c",
        "indicator--2dfb9f7c-f001-4838-af03-91cb59ae2b9a",
        "indicator--5876fcc7-7648-4fd6-9918-caa97a3916fa",
        "indicator--7d064174-205f-4395-8794-434b3105dbff",
        "indicator--614d9d8c-686f-41d5-b789-c0a9d8329b2f",
        "indicator--315ed9c5-aba3-4163-ae64-fad84520a880",
        "indicator--4a5cb570-e033-499d-a2bd-0a1bbecdea46",
        "indicator--b5aa8776-8442-4677-9474-04854d21d322",
        "indicator--6e94d7e7-05f5-4e64-b008-9efde01f0997",
        "indicator--3ee5ff9d-dd40-453d-8073-f21d5fac2aa5",
        "indicator--41c55615-8357-4b5a-9611-5f7eaffc0bec",
        "indicator--52c358d5-0649-461c-a734-893a9939e7a4",
        "indicator--2feb3654-5bab-4b4d-bdf8-04c627df8cb4",
        "indicator--83d699d7-915f-4060-903e-27ae2c7f066e",
        "indicator--962701da-bbfa-431c-a6c6-3733b227e140",
        "indicator--764f2076-50e8-4afb-806b-3950a22087bc",
        "indicator--21a1f1aa-8f1a-4186-b5d8-64754807c750",
        "indicator--6a437c58-b229-4cfa-8bdb-649f1d9550d5",
        "indicator--2930bde0-e7d9-48cb-b037-51ec14e7ec88",
        "indicator--7940b703-222b-4d55-ad81-96acbdb0e0c6",
        "indicator--bd9ec3ed-b696-4249-b5fd-e7f4a9034874",
        "indicator--a499dae7-987e-4a69-9b13-7d1add57633d",
        "indicator--ea92a6cf-c511-4645-bcd2-09bbc69784a2",
        "indicator--dc01f7ac-fb03-4d1b-a8e2-27371d09004d",
        "indicator--379ec286-cdd8-4064-9779-e6b64e30a848",
        "indicator--7d58cc5c-9793-4181-96af-69ccfbd8bf0d",
        "indicator--3fadb1eb-937e-48d6-9004-0e3a5d73f073",
        "indicator--2d38ddbb-02c5-4285-a139-1fc91253bd03",
        "indicator--c5e27439-4d11-471a-a1bb-d82fe2f44054",
        "indicator--4cb3642e-c275-4e22-a9ea-329ee2900f30",
        "indicator--f7637ddf-d1a1-4081-9d15-d976d62659c9",
        "indicator--8ea34d3c-c7f9-445b-8c6e-c52d93b3429f",
        "indicator--ff9a951b-9991-47f5-bcd7-0045733f03b4",
        "indicator--b21eddee-40f0-4d20-a6c4-e3799595fbe1",
        "indicator--02bec273-c43f-4178-8de8-66894786a296",
        "indicator--8a8bbfd5-8c1a-44c9-82a9-b798004af279",
        "indicator--c3d6bb35-ee22-4c55-bc2c-0fb668790fa8",
        "indicator--53f955ae-3494-4b0f-ab50-0efd62902440",
        "indicator--d020faf6-0fb4-4f5c-a23d-7edde044b961",
        "indicator--b15360be-d996-45cf-bf2b-637f0c262e4e",
        "indicator--fb77f30f-2708-47b5-b7fa-46e17a9f3f42",
        "indicator--d6821c41-e209-4401-91f8-34ed8602aba4",
        "indicator--46540cbe-22ed-4db8-99a2-ae7b3657c84a",
        "indicator--049ddc40-6283-416b-8c86-303caf017342",
        "indicator--5ee5aa00-22d7-431a-a0a6-2a6b3a236fa3",
        "indicator--08767ca3-6073-4569-a31c-83352f7ab186",
        "indicator--69a73c4b-4549-497e-9d9a-8ddebcb237b9",
        "indicator--d3416f16-c914-4603-a838-3a008f9a5134",
        "indicator--9de6679a-b550-4050-84ee-550928b91958",
        "indicator--e0dab5c8-fec7-4932-af6e-f43a9a9d5f23",
        "indicator--56fd4c2f-0cc8-40d0-bf3e-bbf286b98684",
        "indicator--bc0ad405-0cf6-4045-800a-0dd9b76d85e7",
        "indicator--abaaaff7-a6ba-4abd-b963-16ac7fec5460",
        "indicator--4f4a2851-f9fc-40eb-a980-3d471a8ff54c",
        "indicator--0e82169b-fb6d-4acf-bed6-1cc30502d346",
        "indicator--fa5423f8-6894-4eba-b4cd-fdf18c39bb47",
        "indicator--b4ad24d1-a469-4a23-aa2f-0e3b3e50c981",
        "indicator--407a13c2-37d3-4f4b-9a6a-738d71c439ad",
        "indicator--75e4e3cd-78dc-45a0-aa26-33f807b33c02",
        "indicator--bd64cd53-e032-45cc-aa31-dc2d3effd229",
        "indicator--b6bc8845-fc1b-464f-881e-8b06f6aa94f6",
        "indicator--34de5013-3161-4628-a85d-e078dcb913b7",
        "indicator--b2e25214-65bd-45c9-8e05-863f29f01468",
        "indicator--c4430f63-2c9a-4520-8d58-29890c406cf4",
        "indicator--fc7cbb89-38a4-409b-9a9f-57e8c06659cb",
        "indicator--5acdc39d-2ca0-49c8-acee-3254da1f6b87",
        "indicator--7ac3e886-c209-476c-bd17-4f18786e99a4",
        "indicator--15fae536-a8e6-469b-824c-0328a263bff5",
        "indicator--17f662d7-3d0b-452b-998d-e96b12668db5",
        "indicator--078326bb-4688-4a71-9716-4ad5821b62cf",
        "indicator--164c359f-966e-4df8-ae3c-600cf131ecb4",
        "indicator--6efdcd75-78ac-46dd-af89-c2b7b9c905a3",
        "indicator--2915214a-2d99-4521-996e-82da7faa3990",
        "indicator--c8a205e4-5948-4ea0-8b51-5ceedffa107d",
        "indicator--cbcdf3f0-4d9d-4762-b17b-1e9d4cfc64de",
        "indicator--586c21ef-e022-4361-89f2-7a01879f7a02",
        "indicator--f74e206b-9437-42c0-984f-7d0851ad893b",
        "indicator--7faab1fa-8822-4d41-82ce-6547ad8e6aa8",
        "indicator--de0a2141-0e84-4f6f-9cdc-e7df7bfb2174",
        "indicator--fc280feb-f7ac-4669-b400-b58b1b5dc32a",
        "indicator--8d0b92d9-c2ea-4253-840d-a8b38f8ef340",
        "indicator--887cf9b6-545a-476b-8be6-2475a927d245",
        "indicator--5fc664c4-9b02-4d2d-bbb4-c7d9c213cebd",
        "indicator--4aa2dcfb-f640-486d-ada9-49347e2c9343",
        "indicator--66c47865-1184-41a5-9814-e6c8a8e7b403",
        "indicator--d1c8d585-456e-4948-b5bc-f110a1c2b127",
        "indicator--63c85f5f-f8f3-470e-86f6-8c5d5e8d4ca7",
        "indicator--beb9b60b-b7e7-4bee-9544-a8e750172457",
        "indicator--ece9cc9a-82da-44a7-b4f2-3828b7628597",
        "indicator--27720235-27d3-4957-a0d2-d843eed19eab",
        "indicator--a7b098e2-bf19-4ba1-88d2-b4099ae759b0",
        "indicator--dca530c7-c5e0-41d7-9609-6bc2f0f97044",
        "indicator--15d75750-f1aa-4732-85f9-93ead2be7ee4",
        "indicator--2c512dc7-22a0-4be8-950e-abc0aa08ec5c",
        "indicator--6b229a95-96b8-42f1-a3ef-6c19c983bf4c",
        "indicator--4bca23de-50c9-4487-b139-ea704de8126a",
        "indicator--96199207-705d-4f19-959a-3d53c9a0a8bf",
        "indicator--13b4fda0-522a-46aa-875f-d38173d12119",
        "indicator--73425714-c45b-43d2-a69f-4a0351ff2b31",
        "indicator--3cdc132d-9929-4d9b-9748-71749461ecec",
        "indicator--223f94b9-bd16-4e18-876e-2ea98c029685",
        "indicator--8eb307cf-afce-4a77-9668-8d5059db3c36",
        "indicator--7655b28d-9823-4404-ac21-2a5bf4d58042",
        "indicator--141e2abe-8c9a-4fe1-9921-ccff713d56d2",
        "indicator--e53b8332-05d7-4b79-a008-9ad19c50ab4c",
        "indicator--ec5a4754-1dda-4137-ba5b-1046155ff7c1",
        "indicator--0fc7ce3e-53c3-410d-bfd3-26e524ad9978",
        "indicator--5a3ba493-2f0d-4450-bc8a-2d421d9414ea",
        "indicator--b244d925-f849-4a51-bca0-5d4535183f26",
        "indicator--96127c12-74be-407b-ba93-210edacf52ac",
        "indicator--ccfc493a-0a23-46f8-bc0d-50fcb399c635",
        "indicator--a3e896ce-231f-47c5-9814-643979b06f9d",
        "indicator--8fab25a5-bca5-4b86-a78b-c491f7c1a9da",
        "indicator--6d9d6191-2d9e-4a26-b914-f203ce09f5e1",
        "indicator--dd9f7f0b-74f5-4c2e-830c-b022ef223628",
        "indicator--62dbfa40-9415-4d7a-b14a-6a3db082d1b9",
        "indicator--cdce0844-8b72-45cc-b2c2-19619ef8036b",
        "indicator--1368571f-2dc1-4418-8492-e4f2c66afe83",
        "indicator--67f4226b-02d2-4490-8663-2e68948d4c3b",
        "indicator--9fb1b7be-de3f-4b17-9c8f-f0762cccc70b",
        "indicator--c69f9b17-ccf7-4bbd-89ae-837db1946a1c",
        "indicator--58a1cee7-e7c0-489d-b353-cd2ebe756aec",
        "indicator--cbc23f0a-6773-43b2-8673-721265c6a7f7",
        "indicator--77cd0580-1265-4955-869e-abc3112424ae",
        "indicator--2864b943-3886-4b2c-9272-398d6e57c116",
        "indicator--91e275e7-bae7-4688-bf29-0bb1df517b2f",
        "indicator--0434ecf6-7866-4d84-be09-af09c837b114",
        "indicator--75db9821-b035-4361-a40c-89648f8bb581",
        "indicator--d8553f65-41b7-4e0f-bd13-8f403eb44d35",
        "indicator--f66dcea3-8627-4714-a9f9-0c5f2f9c21b3",
        "indicator--04fea1e9-03de-4f8a-b35c-85e0903a7296",
        "indicator--4174a518-a30f-4a3d-83d5-6dc9715a4191",
        "indicator--ab93690a-759e-4ec9-bf49-5418d390f9ae",
        "indicator--0ad61949-5a16-450d-a1c1-026950fe9a2f",
        "indicator--d268cbc5-90ed-4669-87a6-c10dfc606146",
        "indicator--3c682076-d096-4ec7-ab6f-a2bc939f0f36",
        "indicator--63e05af9-773b-4604-b700-84fe65c3b5bb",
        "indicator--9a992da8-0669-40c0-9ada-304d14552518",
        "indicator--5fe5535c-49ed-4a05-a297-58debb5f8d26",
        "indicator--1937c082-f160-4301-9200-7cd564736055",
        "indicator--2910ce39-a374-458a-ba7e-5eba129c148c",
        "indicator--47ace88d-961c-48d3-8fa1-f717c1347b15",
        "indicator--d3e6338e-f0be-4b91-b21e-3e348c498769",
        "indicator--c02235f8-2a5c-488f-9afe-a624ab862450",
        "indicator--6d8714d0-856d-45c4-b305-1b57f3ce92e3",
        "indicator--976ed7fb-565b-4a36-be45-ccddbe4eff22",
        "indicator--278d8cca-c6c4-4771-ac8e-ee050e618953",
        "indicator--6bf66e43-7c0e-441b-8f25-efc930cf0f1a",
        "indicator--30b43fe2-ee1b-4799-b868-cf7be8d237a6",
        "indicator--38ec0345-51da-4144-9816-545b366fb01a",
        "indicator--c467ebbc-6e57-48cc-83f0-bb172787f2e6",
        "indicator--11bed669-8f64-486c-bc52-f0a05a755caa",
        "indicator--f949460b-3cc0-48cf-a8dc-7d95931e0c42",
        "indicator--c2d499ce-bd9a-4bab-b67f-104629804ebc",
        "indicator--7b51d1e4-e0d6-4cae-a0fc-59ed16249437",
        "indicator--bf1b9def-ff0c-4015-9477-2d81adea6427",
        "indicator--11f89c53-590a-48cb-a8ff-11615816e110",
        "indicator--755ff90e-ffda-4469-94eb-dec279f5fbe5",
        "indicator--fc2823d7-dd7f-4490-afba-ba981f900fa3",
        "indicator--562aabdf-6d0c-4843-867a-35fca7f60d92",
        "indicator--e5c1bfc3-6266-42b6-952d-1006eecc9bd6",
        "indicator--129e247b-d385-4229-8a4d-e1e5e7402b1a",
        "indicator--c7ecb27b-0b2f-4e0c-ade6-5d05fee36403",
        "indicator--7c05d323-d3ec-46d8-8ad6-cd66b432eed0",
        "indicator--0c474e9c-adca-4422-aeda-0ce4b404f9f2",
        "indicator--ce650b63-fea8-4a55-93f0-4961fc213cfa",
        "indicator--378434d0-c1cd-4d24-8f21-fde2dcdbf805",
        "indicator--559d689b-c6f6-492f-8521-fdaac6ad0b3c",
        "indicator--d8794691-efc9-4242-bb28-ba21a06acdb0",
        "indicator--19749206-44ab-41d6-831a-76658776d58a",
        "indicator--6c08eead-da85-4d0e-ac72-d21910aac870",
        "indicator--12d6b640-172b-4bbb-9073-567b36269d11",
        "indicator--5d8bbebd-b3f9-4380-8921-9c82603a21cf",
        "indicator--388a2a48-fffd-4c99-acab-dd06ecd412e4",
        "indicator--019e465b-6221-4882-9bec-a08dd19313b9",
        "indicator--5cc299d2-d9e4-4ce0-af20-d5856c91ab7f",
        "indicator--badbe13b-2b4c-4a18-9281-0f1ff9086c67",
        "indicator--d2533351-c9a2-4280-9356-8d3520b37e4a",
        "indicator--8f315ffb-c305-4a20-a5ab-4b499914effc",
        "indicator--32c1806f-6b80-401b-9da8-dc48c1fda43c",
        "indicator--f039a0eb-f639-4e33-a3eb-5af01cb20c27",
        "indicator--6d045f19-5571-476a-9bfc-e2bf37ddd8eb",
        "indicator--fbfbffd7-14fc-4a21-add9-22e16062be5c",
        "indicator--40a506a1-7e67-4fd6-9a94-02c87cc1adfc",
        "indicator--52b5379c-8d03-47a1-b2d2-c284c5d5bce0",
        "indicator--b66e3e22-4883-470e-bf14-b666c7fe7f95",
        "indicator--88d96bf6-e547-4c29-85f8-486a3ba3b4ed",
        "indicator--c8fa2d56-2df4-4b0b-8339-4d4b85cb3da8",
        "indicator--2a90d400-c1bf-43f1-bb19-ddad8f64233e",
        "indicator--ad28cb45-c98a-4d94-98f5-3df2df0e8e1c",
        "indicator--4f2e996a-8c0b-46f8-9bff-07117b9abf72",
        "indicator--0cfac61a-7b2c-448c-8445-8c760a7b97c1",
        "indicator--97f9918f-6398-46ec-a078-e60a9f682c63",
        "indicator--f4ac4730-420a-44e8-a21f-780aa925d2a8",
        "indicator--b323bc15-1403-4a2f-bca3-4493c60a42f5",
        "indicator--1c8d69d9-74c0-4f4e-8aae-d8de80430d82",
        "indicator--5253f5af-7e3b-4c42-9c43-bf7a22bc7273",
        "indicator--9afe541c-6721-4634-b526-7b2b90deba15",
        "indicator--964f8e6b-a4e8-42e2-921b-70af00cbe8d8",
        "indicator--46db8633-34a9-4b11-9ee4-2e5c1ac55cb9",
        "indicator--1b7ff201-66bd-40cf-870e-a931acfa6fa1",
        "indicator--e97147ab-04c3-4dc0-b5f0-0a62b751b1a6",
        "indicator--653a046c-050d-4855-b05c-5e7f8fdb5282",
        "indicator--83daa9e9-a8f4-4ef2-95c2-d7f2753a9413",
        "indicator--579a6cde-b708-43d0-9ac4-a921d05da757",
        "indicator--2bced7fa-be4b-4e5f-b88a-2ced3e70d8f1",
        "indicator--827fbe40-164d-4a57-b840-a6e82cfbb1ad",
        "indicator--10c785ad-b1aa-40d9-8c3b-01ccc59f1c6c",
        "indicator--42eb2472-a28c-4388-9be1-c63438f26396",
        "indicator--8b268aa8-3b1c-439b-9daa-9e24d0f52922",
        "indicator--0a3e135f-3c74-4584-8609-b250b8440a50",
        "indicator--edd61559-b63f-4eee-ae00-76ba703f605c",
        "indicator--0bbc9abc-f896-4a64-8815-9ad0a737a56b",
        "indicator--60b8b2ec-389c-4896-aac4-0fdcd229f91d",
        "indicator--fbe71223-e8aa-4952-bead-61f598b2da49",
        "indicator--7d23486c-15cf-4b8b-9a85-304f7e39b207",
        "indicator--ad7724f4-bdc3-489f-82c4-cbbb984b87c4",
        "indicator--b1136318-a0ff-4a82-b0bc-1538303084e8",
        "indicator--99cc663e-1d02-4987-89b1-db98b61e0a5f",
        "indicator--b9a9b498-8651-42c4-8d6e-22483ad8c0ce",
        "indicator--1109fdcc-632a-4587-adfa-34a6cce678ee",
        "indicator--b299e86e-d3c4-44a8-8b25-5dab2b0f0cd1",
        "indicator--b45bafb0-c0b7-45aa-b046-a7d2cf6be622",
        "indicator--b51da822-ec60-4e8f-aca9-161e12005b28",
        "indicator--4c7c73b2-07cd-4408-afa4-95b59526e248",
        "indicator--6da07184-5f78-41f2-b295-26fdc8195f67",
        "indicator--801bea5f-58ee-492e-a82a-bbfdd973810d",
        "indicator--3c9f1f25-1827-4405-9714-0ff7958b64e6",
        "indicator--808e41a1-9d93-48c8-9560-06e7eedd145a",
        "indicator--e0320ab6-96de-49f6-8f2b-afc569747eb4",
        "indicator--2efcc425-274b-4c9f-aee3-ec7aba8c4764",
        "indicator--4671ae32-0b5a-4d2f-87d1-57cf70302f7c",
        "indicator--84237c65-456a-4993-9307-06b92106568c",
        "indicator--c4d874a3-0f0f-4df1-95ab-108ae1d65f55",
        "indicator--5d9dff7c-8d36-4dd1-9dac-4433c7acb147",
        "indicator--49ff3054-1c76-4cd7-83bf-6da795f87d53",
        "indicator--2955081c-8696-4a00-b4cb-f510b7cb6483",
        "indicator--21950104-d0e0-49b5-be6e-65cd710f3f2a",
        "indicator--db7d927a-4b0e-48fc-91c2-3c9f9a3a4d05",
        "indicator--c8d7f83e-5f8d-42ba-99ed-cdb3b5ded5c8",
        "indicator--dab58844-5409-4919-a756-04c7f65092dd",
        "indicator--65c36a13-84d1-4198-846d-c043e4c7fc01",
        "indicator--7a990a90-5c65-4a83-97be-8f59206478c2",
        "indicator--128ecc76-3253-4ae5-b3c7-38d11b1062e0",
        "indicator--5ab6f81a-4765-4397-b057-a3f2be46a4fb",
        "indicator--2349e68f-5f6a-4da4-9347-da0395dd62e0",
        "indicator--fa17d55c-4b8a-49e0-a0c1-68c01b77fd6a",
        "indicator--61a40e57-20cd-46a5-b550-c45c66a13fe4",
        "indicator--405b936b-724a-44c9-95ec-e115459c5141",
        "indicator--794bf065-70ab-4c6a-a293-32ba888bf194",
        "indicator--549956b9-5a42-478c-8940-7881a5dbeffe",
        "indicator--187b48b7-a60f-48ee-9416-bceba37f0cf0",
        "indicator--b1925266-7590-4cb5-aa56-655bc0093efb",
        "indicator--59d3ae83-218a-4314-9574-c90a01b14925",
        "indicator--56a9d4fd-d536-428c-8c25-64c55bfbebe6",
        "indicator--ef78c7dd-31e4-44af-8dab-8f099fa3a117",
        "indicator--4a7486a4-fe12-4ad3-a690-8757e30d9b49",
        "indicator--4342f417-5b97-434c-9414-1cc23c1f5724",
        "indicator--8cbd1adc-9a35-4f97-bc9b-ca1940ff1d4f",
        "indicator--dc7bf5c4-b723-40c9-a98e-5f1355e01913",
        "indicator--2d4b8455-841f-40f0-bd04-28519034dab8",
        "indicator--fd54ec88-4d9e-4c8d-b2cd-fbda32a2b831",
        "indicator--99ef00f9-6a42-44b0-9fd5-8040812798e4",
        "indicator--279adb98-89e9-4f31-9813-682e893be55c",
        "indicator--29cf73a4-b3cf-4936-b5e1-a1e068a31328",
        "indicator--3b345870-2f37-468b-86ad-ed9175c93a62",
        "indicator--d12a7517-f9cc-47d9-bae4-8e8c6eb0c356",
        "indicator--62020b8c-9275-42aa-bc98-68342997f33c",
        "indicator--20d2f7d6-09c3-4390-a343-b0cd093662a0",
        "indicator--9c7b833b-612d-4a6c-86bc-0392226b3c76",
        "indicator--120a2b53-3849-4645-8945-f9272b91e848",
        "indicator--5d2329c1-ce7b-41a4-be33-6886be27cf93",
        "indicator--01455fbf-3b68-433f-871b-b74502b4ae96",
        "indicator--3ac5a14d-9380-4ac8-9092-2c6ea7f8cf9c",
        "indicator--11bdfed5-4c60-447f-b374-9bb3a45c7410",
        "indicator--03158ee4-94e6-4caf-b5f6-e41755de1e25",
        "indicator--ed5d2a42-8b60-488d-8c56-73a09ac5e601",
        "indicator--6ca10e38-7bb4-4714-bcb7-ae13b7a9cf7d",
        "indicator--9c4825e7-ec68-4e7b-8e02-0c623b0604d2",
        "indicator--73a1b1a8-9e69-494b-9501-edd75f3a43e7",
        "indicator--ac2a4188-80a7-4331-b675-e0288356e721",
        "indicator--a943ac87-96b1-4b91-8718-ed2389a32a23",
        "indicator--f31c346a-8257-4477-9aee-67ff2d14821a",
        "indicator--e4eddad1-8df4-4482-8bd0-a367dbab2d4c",
        "indicator--aa494324-c992-4f15-9f85-1e1d558609ad",
        "indicator--67b38b69-78cd-4bf4-8eb7-f545f61eef61",
        "indicator--04575384-76e9-4364-86f7-4a88cce6aec0",
        "indicator--8795b599-04b5-43bb-a0cc-4a44ed9757b0",
        "indicator--7f58b2d2-a92f-44b0-ba82-793d734aba39",
        "indicator--3a8b4bef-a48b-471d-8464-ebc1ce93ee34",
        "indicator--b9e5c178-fa88-4bfc-8370-96af9025a5a3",
        "indicator--56b60d0c-e779-482c-976c-711287847aad",
        "indicator--33ab3446-0f28-49dc-b9e3-7168d1e51bef",
        "indicator--36adc0f7-2f56-4067-8bfb-dec6d65dfb19",
        "indicator--8d541bff-f3c1-4a5f-8cbe-9874ce3b7012",
        "indicator--13c0a493-3b8b-4191-afb2-dcc513536c91",
        "indicator--cb0a7bbd-9cf1-40ff-bc1f-83f7fb4b3264",
        "indicator--ba3c0a63-ef24-4189-bbb6-2da5c242558c",
        "indicator--0b3cab83-bd36-4bb3-a636-e53c701b214e",
        "indicator--30e6ba9c-80b4-497e-80a1-6da4792d7f34",
        "indicator--c3fe591d-246f-408b-872d-ec0146ba132e",
        "indicator--f38d7fe0-f202-4339-abbf-5c8f96bd04ce",
        "indicator--2c89171c-c7ef-4adf-b9f8-f5c8c7b9d844",
        "indicator--41c98c99-501b-4d8c-ba86-b9b40477d211",
        "indicator--8a3a13e9-0c16-4c96-bf54-7c434467b63b",
        "indicator--042c07c1-734a-4d03-8b17-e2ffe654fa38",
        "indicator--0598e181-ec0d-44a8-8574-460f8fd3ea8a",
        "indicator--e52f12ce-e95f-403f-bcf7-9b3db2211858",
        "indicator--5abce110-907e-4cbb-bf8c-95b5cef21ab9",
        "indicator--cb927ac1-4d34-41d7-95a7-55b0b92ef083",
        "indicator--9237ffca-9bdf-42e4-a11e-c048efd9fab9",
        "indicator--1f10fe11-4c00-4f2f-a94a-62fbed7ccc2a",
        "indicator--9bb9b8c8-c472-401c-9fee-87723ecc2900",
        "indicator--1418240a-e351-434e-8c89-29a37c03ff41",
        "indicator--2cb1f561-b0ad-4136-8b61-8fc0d84861f8",
        "indicator--8df053fa-352c-4913-bdd9-b04c4862fad5",
        "indicator--3642bddd-cecd-4a4b-9060-4963481d8aea",
        "indicator--ca2ab586-c585-4e74-81b6-3519c2964731",
        "indicator--8d297765-eb7c-4622-9606-7ebdf7d415ab",
        "indicator--672d5831-c75d-4fe5-9d8f-a0c3626f6f9f",
        "indicator--1ce10881-54ed-4753-99ec-f281886c41a4",
        "indicator--eab6f0d3-d241-42cc-8cb6-7d0f753c4725",
        "indicator--46fec1e9-14b4-4feb-ae86-b315a445e813",
        "indicator--c3dd1678-86b1-4216-b1cd-4d3f61b9c6b5",
        "indicator--b893af61-73ff-4657-b74d-c8205a2d167e",
        "indicator--5c6426f0-3519-48be-9859-db09d59c10c0",
        "indicator--31a722bf-15ad-4025-9e85-c9b1b9e13028",
        "indicator--7219aad9-dbc3-4ce3-8388-561beee46175",
        "indicator--9fa37e43-d99d-4d0a-96ca-67fc8b193db0",
        "indicator--b0769509-bc7f-4571-a4fd-97b9ff84f686",
        "indicator--14fa0c6f-c5ba-4065-9828-16eb3d750103",
        "indicator--04983f96-61f0-4247-a426-0a7463c94e43",
        "indicator--dd9d5c03-ba6c-4a39-85b0-11da3e7425a1",
        "indicator--5cf49f30-b480-4e30-ad7c-e3df116c9c65",
        "indicator--378bbf40-2daa-4961-8bd5-a5bae6f98684",
        "indicator--4067d81f-3b7a-4edd-90c3-8e0e3928ad1e",
        "indicator--013694d9-6b42-4300-8a48-b5bcabd021c5",
        "indicator--8c89fb6d-42eb-4058-9756-b648344683ad",
        "indicator--85fdd918-b7da-4152-9cdf-16d8032d10fc",
        "indicator--28967a33-889b-4056-866e-96f3f2d3e21c",
        "indicator--733909ad-e7b8-4f1f-ba12-9c6426b45650",
        "indicator--85c4dffb-9aef-45de-890e-6043b7835bea",
        "indicator--12e87400-30ac-4984-81cf-df2f66913043",
        "indicator--66a0241d-a5b4-4e98-a4be-65fe77eff654",
        "indicator--1b361286-6ade-4d62-b77d-7e4b6562983d",
        "indicator--e6c9c779-4e88-45cf-a04c-54b28bb33bcb",
        "indicator--fdfc767d-3012-402a-84b1-f55acece7c35",
        "indicator--229fa771-3561-4a11-99a2-76352af19254",
        "indicator--c36157c2-48c0-4d2a-9f56-141871b0d8e9",
        "indicator--e5745c75-6954-4b63-acf9-7992f894f8e3",
        "indicator--e78b748f-a5e9-42da-a112-2872911859f7",
        "indicator--093b53e7-34df-4b65-9819-183503b0e970",
        "indicator--1031693e-2b25-4af7-a19d-7dbbbd794d83",
        "indicator--0ced2db5-626a-4bf8-b158-7f28da62f510",
        "indicator--ae80bf14-098e-478f-8a2c-5305e0631cb9",
        "indicator--600be6a4-4c0c-4213-a532-8494abc4c099",
        "indicator--420350ba-21b9-4aa3-916c-9cbf367d0aba",
        "indicator--fbe7af04-7de7-41ab-9a3c-78898d66541e",
        "indicator--026975f7-d041-404f-b23e-4c8951aaa0d0",
        "indicator--d83d6fc8-74c6-48f8-9dd1-dcb08b1b5408",
        "indicator--93fa5cdb-42be-4446-b28e-a4b328843225",
        "indicator--15f7096f-5a39-41fe-bc25-12d66ff3f150",
        "indicator--36aff66c-644e-4830-b407-284f9e017b78",
        "indicator--4ea05228-b316-4d56-a5d0-cffdabc7438c",
        "indicator--c1e3a8f7-5f48-4f68-9fcb-3b139e65e5bb",
        "indicator--a7bd9725-e481-43b1-ab3d-db6e21486ac1",
        "indicator--79d4cc36-3e9f-41e8-9a0f-2c94aba48e48",
        "indicator--5f191fe3-6156-45c5-a394-acbc2c1b3c86",
        "indicator--4c5f893e-6e77-4d3d-a772-ef8dccccb160",
        "indicator--a2f6cc02-b477-4aaa-91c0-5318a669db37",
        "indicator--e363f7a4-7cf4-4f04-91d1-528888657f84",
        "indicator--ea551429-a4e4-47c8-b9c6-d07f6a387730",
        "indicator--4ee71029-9f7e-4fe9-887b-5eda62c67d8e",
        "indicator--fb722800-be29-4687-b8f9-2653af4098fd",
        "indicator--a7130a77-96de-4597-be13-d6fb8e19d66d",
        "indicator--b1c97356-bbe4-444e-af6f-0a5433e64b49",
        "indicator--2a07d7c3-5edb-4573-95c8-64f2d45786c5",
        "indicator--47816877-ab8b-47d3-beea-341c09772672",
        "indicator--1d8e0c31-707f-4df2-bdfa-7208a7efd5b5",
        "indicator--98fecba9-2469-439f-98ca-dd804f89269d",
        "indicator--c76aeb91-3961-4e5b-81ec-62f9b24bb0e5",
        "indicator--4e17ce7d-936b-4176-97f8-31cffa4d722e",
        "indicator--890cab7f-50b3-4ff8-801c-628773870de8",
        "indicator--3a792725-7abb-4277-9de2-73fd60087549",
        "indicator--347f7b08-e064-472a-98a3-3e9d8f52184b",
        "indicator--ce6d399a-1cbb-4ad6-bc7e-cee7b5ced971",
        "indicator--ee691412-9e13-4085-b637-2cd73b9855e9",
        "indicator--64f25e71-167c-428d-bbba-698da199ecd3",
        "indicator--d72a6e65-eb82-4f63-a342-4b4b695f1d6a",
        "indicator--d4760efa-c1ff-4fae-beac-794bd982a261",
        "indicator--d1b159c7-ab87-497a-8fae-f236cc469bb2",
        "indicator--c63ac833-6f36-42de-b4e2-e92a2c70b3a4",
        "indicator--697cce24-05ba-4e07-aa81-4993024d0623",
        "indicator--ce668c94-c016-4ace-8280-67d4f15684e7",
        "indicator--45eb9958-29f0-4cd5-9885-ee201f49a9a8",
        "indicator--0a3fdcc5-3e55-4e8f-95de-8c04148b3a3b",
        "indicator--a68c3be4-b721-4564-a7aa-e48aeaf78ab9",
        "indicator--c3d5a5b3-d121-4b97-a4b1-add8e52b586d",
        "indicator--4c312572-2a16-405d-af3b-35b6b6813037",
        "indicator--c1ecdc01-23c3-4730-82fa-0d49feca56c3",
        "indicator--0f9d045e-acd5-4809-952e-11d669329666",
        "indicator--2da53215-990c-4ca6-9acd-94a2ad385114",
        "indicator--406ccc66-5572-420f-a0e5-ef28ff6ca8a9",
        "indicator--f24bce49-2670-4df4-bdc2-46f51c864415",
        "indicator--19a16caa-ad22-4cf9-943a-81165d8e6062",
        "indicator--6dc88074-e2b8-43df-9942-128cf61127a5",
        "indicator--4de558f7-78f7-47c1-a7d0-04792884d862",
        "indicator--7c1aed59-cb99-44d8-b4db-eb52b7ea79ce",
        "indicator--e223d88f-8f85-4520-a916-46a3ac38bab1",
        "indicator--dbb143a2-341e-4012-8d48-95ec542edacc",
        "indicator--6030dd0e-b1f4-4972-a141-bbc10d3a5f58",
        "indicator--aceb49bf-c37e-4065-b6a6-02edc922215a",
        "indicator--c0775695-4517-4859-85d4-16b11ab37288",
        "indicator--e2d23c18-f4b2-4a4a-be95-83359bb6ed81",
        "indicator--6c80be06-ac0f-4eb5-a012-b5b8b66de133",
        "indicator--52fe56b4-1f4e-4aec-b4d7-bd090c4ffd24",
        "indicator--dfedb572-ebdf-4da5-856e-8808b94c6125",
        "indicator--64dffaf1-4a1a-4c00-be3e-b835d0f95302",
        "indicator--a7f819c4-f2b3-4097-82c2-d9b73e0fbe79",
        "indicator--d78b36ef-0375-4f30-94c0-d6b82d59e4c0",
        "indicator--fcf19aec-8003-43f4-8cbc-c653c6f72dff",
        "indicator--262afe6f-08e0-4198-b156-f99b3a80c83b",
        "indicator--a6957b5c-148c-442f-84fb-380fa83a2d69",
        "indicator--c24038ec-dc60-4c29-851f-8887edf9bc8c",
        "indicator--8bae08a2-790b-4d37-a2f4-f833e3ef3fb9",
        "indicator--5b4521e6-5ad5-4c56-820a-d8990d9c348e",
        "indicator--889d01bc-c7a5-4179-be83-7022715816be",
        "indicator--9b89c09d-5cf6-403e-bcd6-3f41628f1121",
        "indicator--0e4fe60f-6d3a-4b89-9a12-02b974df2e2c",
        "indicator--afce727c-de26-4a24-8b94-8d1a2095da6e",
        "indicator--234ee13a-5c33-4977-a807-baee015df37b",
        "indicator--b3fee87a-4dce-4c03-b7c7-a1e9e2a2253f",
        "indicator--6cc620d9-4d79-4955-8b60-0e84516e1bd8",
        "indicator--927668ca-97c1-4f68-9fd1-bd48a0c214f7",
        "indicator--dc19d76c-204e-4c0d-a6ce-029b238d31e3",
        "indicator--b7fa5d27-9bb2-443b-8a85-1777b2dd8e9e",
        "indicator--e299b081-f3ad-4150-a9a5-96d1cdbdf7db",
        "indicator--ade4cd94-e8a4-40f0-8803-504cc4f3ae65",
        "indicator--58a20621-13c9-4e20-8d26-57e66188491d",
        "indicator--77b9c6d1-125d-4912-96fc-8b9fe0f1aff5",
        "indicator--8ac2642c-ed00-408c-9fd8-e4b55db4e8e3",
        "indicator--2303acee-2166-4ffb-9d86-d3741c8eb264",
        "indicator--5a159ee4-b440-4d5b-badc-928a608c485f",
        "indicator--657609fb-0b78-4ec8-9cea-080b90eccb97",
        "indicator--761576db-abd5-46b9-ab91-a594352149da",
        "indicator--791e714e-eb8a-4df4-9267-890922c11ad1",
        "indicator--ea1a9b4e-e739-463e-8f90-c7af8c2fa606",
        "indicator--26c1b01b-fcba-4ecf-bf58-62cb41355536",
        "indicator--071d8ad7-7da7-4ebd-8a9c-079ca8e5120a",
        "indicator--7201b34b-d235-4c20-bb64-16c94298a0ed",
        "indicator--aff01639-5fed-452c-88a2-0c15de03d5c8",
        "indicator--bf587661-569b-42e9-b965-63e3ed873d92",
        "indicator--0aa8bbb4-23c8-4a2c-bb70-229b0a580f18",
        "indicator--4261061f-c9d7-43fb-8e1a-f1a579a1cb75",
        "indicator--e60fed1c-4d2f-4798-bec5-d7aeb65423e1",
        "indicator--d5364081-3480-4139-9894-855b8073df55",
        "indicator--e882458e-b812-4802-bd3d-f847611050c2",
        "indicator--7728432d-1627-4b37-a210-b178b25f1fd7",
        "indicator--b90e2630-c5d1-42e3-b2db-758804375546",
        "indicator--563064fe-435f-457e-b8fa-d7effceacffe",
        "indicator--78ec1ea0-3658-4f81-964d-3345115de691",
        "indicator--a5205c8b-16db-4d47-a0a8-1b0cd67689c2",
        "indicator--b1bebe09-ba39-45b7-9394-6e456148cfbe",
        "indicator--f2188abb-1323-4d93-9dd7-ccf6bf987c97",
        "indicator--b4a6ba9b-f1aa-47dd-9f9f-7bd4aaa84437",
        "indicator--12592e65-5bbb-498c-b2e0-bf60b50a1b36",
        "indicator--8b5b33cb-a955-40dc-aaf2-16876a3dcefd",
        "indicator--5ddb96f9-07fe-4a64-90c6-3c66f97ce512",
        "indicator--5fc2451a-96e5-4f7f-bb1a-02e7c416e4fd",
        "indicator--15387033-bb07-4aed-bf18-39b0054597cb",
        "indicator--025141f2-548c-4c5b-8d59-3d0fe2dccf79",
        "indicator--0e75461b-8bca-481f-bc28-98aa53e7328e",
        "indicator--ed938d28-aeb4-4795-abb9-d3fecb6e0bed",
        "indicator--d7d1ccc4-b7a2-43fd-8c57-501e2788660e",
        "indicator--8abfc61a-f7e3-4230-a985-7b8a9d78ff4b",
        "indicator--a4b68209-009f-49d6-b052-e4568d2e2819",
        "indicator--2416def7-950f-49fb-aceb-456f42008713",
        "indicator--e24c625f-1d68-44bb-8996-ef7378f0c7df",
        "indicator--573ac3bc-69fa-4a57-85d1-704794461584",
        "indicator--f6625ede-ade2-490a-ad10-31559272cee7",
        "indicator--208c04ec-cf62-4af5-8ea1-4dae32dc900c",
        "indicator--ebfa5bd8-c82a-47b8-a69f-4e637e296b33",
        "indicator--3b0d852c-e7bd-4dc7-baf5-78f265ada713",
        "indicator--20491006-5c5a-4e90-afe4-e3898be99529",
        "indicator--8e3acc7c-5d55-4655-8099-d49bd15f7809",
        "indicator--25b16f2c-5843-4394-b415-dc751882dbd6",
        "indicator--962460d9-491a-427b-9a5c-9cb37c88b93b",
        "indicator--2395bd79-e099-40eb-815b-48a672afba3d",
        "indicator--da4c5267-27a0-412e-87fc-edf02ee9b52c",
        "indicator--934ae654-8db3-41f3-b649-c1c46b361615",
        "indicator--6bddd752-e969-417a-8888-5e40cd8fc9f8",
        "indicator--6c1ffb75-f44b-464c-b0d1-b28d901f7dcc",
        "indicator--945fb708-b02b-4d74-b87f-8fd35012579f",
        "indicator--f5f6d043-2a62-486f-a235-95fdc9487cdf",
        "indicator--2c5d8925-12d7-4691-944f-c67c2a8bc51c",
        "indicator--eae875d8-7dd4-4b48-a135-f8ce47a43015",
        "indicator--7c4ab538-e0a6-45ec-a7d8-8c122a5dfba6",
        "indicator--e3a50a29-0094-414e-9dc1-01d52773827d",
        "indicator--ddb61e5c-c511-45c8-96b5-1adf6c875d50",
        "indicator--96680d90-ac99-4f22-be22-4fcc891deb59",
        "indicator--f72b354f-d38a-40a2-be6e-90b308568a8f",
        "indicator--11387296-69b7-4202-9e9f-40fcb066339b",
        "indicator--60bfa7e3-8ebd-4188-bc02-ae055eafee3b",
        "indicator--372351e7-971c-413d-b856-977e470641f9",
        "indicator--8e7ffa30-3222-4e17-b62e-2a4cb7291058",
        "indicator--7344ec5e-8a2e-43f2-a6f5-b7d9bfb3d557",
        "indicator--8cf190a7-9a6a-4dfd-9dc4-33df723da90c",
        "indicator--2cf0ad1f-0a88-4960-921e-e5176409562e",
        "indicator--07c289a9-6c78-4ab4-9498-f5aaae152185",
        "indicator--43e79460-1aa8-4804-a85e-19a85267bccc",
        "indicator--27852f18-505c-411f-b330-46fc191be61a",
        "indicator--090ac57e-cac8-4406-af7e-45c5635cdb09",
        "indicator--30d1c40c-a3be-42ce-808b-f7fd506db4bf",
        "indicator--577bed55-c584-43c0-bd39-c04d78270772",
        "indicator--4d8ae6a8-9ab0-426e-86d5-f7e3984dd7a6",
        "indicator--22357758-71ef-4bd6-ae0f-07415c2a2034",
        "indicator--aa6259c6-f553-4fb5-a257-061f288bef8d",
        "indicator--1ef8186f-9541-49da-84a5-27c044c04036",
        "indicator--1521d6e2-34f2-44bd-8628-f062aaaf30c1",
        "indicator--e6e89dbd-cece-412c-aa32-a81735367c17",
        "indicator--10d194e5-e9c9-457b-a718-68584832eb89",
        "indicator--0253b16c-fac2-4294-88a5-5447fb52a140",
        "indicator--ea73bb3a-b848-4041-b9b4-a726cd501d38",
        "indicator--b87573bb-b780-448a-ada5-35527c27248b",
        "indicator--ef72d438-f868-4a0f-b423-daffd8978ea4",
        "indicator--c641d8af-2425-4991-98d6-4f06767eb117",
        "indicator--1194459a-4d7d-4cae-83a7-defa2488815d",
        "indicator--908c080b-fa15-4609-901c-a0d67b8e769f",
        "indicator--ad55c147-bb61-4bba-8854-4a1c31860a4b",
        "indicator--15908437-1380-4748-8259-f014fcae091f",
        "indicator--2029d6d6-725c-45d5-8f4d-070ab928ad02",
        "indicator--cefa8ced-6672-4a0d-93c1-e3f250f8169b",
        "indicator--60803332-6db1-47ac-84d3-ac8b41c10dc7",
        "indicator--e09fa7cf-c404-4c30-84c3-0bb61e7aef37",
        "indicator--06e0866d-4e74-44b9-947e-333ea070d602",
        "indicator--f1f09a05-1bf1-4f33-9cb0-76c14a8c8373",
        "indicator--83dfd59b-7d5e-4ba9-afe9-2b22655b3e3a",
        "indicator--9fe71be7-f324-449b-97b3-5d7cf3bde889",
        "indicator--a6db1afa-5a9e-4269-a904-da8702622578",
        "indicator--9b632445-d009-4bc8-b7ed-f072a89a8d31",
        "indicator--8da62290-674b-40c7-997e-9f8a211608e2",
        "indicator--9fa667c6-8f94-4841-8d48-6949154dbc5d",
        "indicator--d3b9ff9a-ecdc-494b-9fa7-dfa3a25c08b4",
        "indicator--13900b00-8702-4303-8acd-f21d8100d531",
        "indicator--f4454849-04d5-4aff-90ea-c91990184787",
        "indicator--a847f3d4-97e4-4d97-add2-009492a4150c",
        "indicator--11ad6527-0667-4081-972e-edacb5508e3d",
        "indicator--34fb5ba5-215f-4c5b-bc32-c37a8f874d71",
        "indicator--a6ecf693-ded0-4e16-9c24-e34b8226303b",
        "indicator--d1772fdf-fb8e-46be-969c-b7715bcc1fa4",
        "indicator--05a9549b-ca0e-42d3-b38c-f586b4db876a",
        "indicator--fbe071a7-3a83-44b4-942d-31465aa19894",
        "indicator--43dcf991-0216-485d-b1c0-fe3a6892f966",
        "indicator--8cf4508d-70a7-479f-9723-c05b8e6e0823",
        "indicator--5d583521-2903-4f4f-beae-6fb1b297ab04",
        "indicator--ff97a5de-5e4b-4a4a-ba3c-4cc11181a7a1",
        "indicator--86064a25-0016-4915-a746-3e54cba5d4ad",
        "indicator--5022a876-ff77-4161-b3cd-577c5e7fdefb",
        "indicator--836b7f3a-0e8d-439c-a38b-d6da9651dfb9",
        "indicator--c0194f2c-8cee-4f30-bd52-f05d5dd6cebc",
        "indicator--d9f09161-101e-45a8-bacf-c155f1a99d14",
        "indicator--31341390-6d73-4521-bb70-0d77b812e547",
        "indicator--0444e682-5311-4995-91b8-9218f315847b",
        "indicator--8ee6a75d-23d1-41b1-ad36-f9d83380f202",
        "indicator--6a6df85f-1ae3-4665-a570-9bd882faae27",
        "indicator--56bb44de-04d6-45e9-a29c-3f8bdf07b7b5",
        "indicator--ac5711c6-8342-4789-ba08-7313ea823c4b",
        "indicator--60992cad-71b1-4607-a403-316bce431b8c",
        "indicator--8ce29ab2-4f13-4ea0-8fda-3c8851507542",
        "indicator--4b041b09-762b-41e3-b217-bc83e77b1c45",
        "indicator--cc430da0-85ef-46fa-b36d-159f830415b5",
        "indicator--49941c27-deb7-4661-9b9f-f10a870af731",
        "indicator--ab24bad7-e418-4eef-b546-efc3a0fd98c4",
        "indicator--a11d2777-aed8-42bb-904e-7314dccc22be",
        "indicator--8b41574f-b1f4-4958-9110-d73a2399cbba",
        "indicator--f286e528-3b9d-4fe9-9404-627f60874dc1",
        "indicator--3be1ff6d-1fb3-4b4b-ad7d-58d48f57e5ea",
        "indicator--d348ecf8-b12f-4d50-a730-9aec7a7229c8",
        "indicator--25cb80ff-8a3c-43a3-8f82-be974bcd4681",
        "indicator--b31fc539-340a-4f50-86ea-e8d6025df4de",
        "indicator--56859250-6687-4494-b143-744a5753c60f",
        "indicator--cd8cdb13-f822-481d-a672-6e77fe22a1eb",
        "indicator--3c895926-bd06-4965-b357-2a4c75b72441",
        "indicator--29f9c37d-491d-4908-8d7c-adce9bdbe21a",
        "indicator--e91110c1-47b5-426b-ba82-731109a8dcff",
        "indicator--b7a39152-831d-463d-9190-a13b03e29476",
        "indicator--ada86f5a-ef30-478c-94e7-5091cef8877d",
        "indicator--70dec905-af76-421e-bbe5-feb2dc9586bc",
        "indicator--324a5f38-ff16-4120-97fe-b3ab69c633b9",
        "indicator--bc7e2700-16c2-4d5b-966f-e70ff36f2095",
        "indicator--7bcecee2-e499-4215-a8f8-d7842ca6a8eb",
        "indicator--e8c8bbc7-3f58-45fc-abc4-8645d5f2e703",
        "indicator--9034d506-3272-49b6-9802-bb60ca60ec21",
        "indicator--c4102e1a-78f8-4b9a-bc82-f7896fb6291e",
        "indicator--b047eb0e-0813-46eb-8b6d-370107ccc8ed",
        "indicator--445b2b2e-bed3-4747-bd5a-762d0e39826b",
        "indicator--b71b5c6e-9925-40c7-ae68-a305a1c9cdeb",
        "indicator--58ab166d-50fc-40e5-8727-b8702facf401",
        "indicator--7afc6d67-773b-40a2-92a4-3dfc969f6b2f",
        "indicator--02e52dc1-cffb-402f-94f5-1bffd5271ff2",
        "indicator--46f83e5b-64c3-4ae2-9ce6-34e2c5489ef2",
        "indicator--6875c3fb-3828-4a11-8685-91e135ecac93",
        "indicator--5b7d8633-e4de-46de-baab-d16493362535",
        "indicator--ba893359-7fb0-4fa1-ac51-a179e402d9a4",
        "indicator--f2de1a75-bb98-44d0-8e1d-c3146ac6d6f7",
        "indicator--4812ea8d-1ccb-4fc6-8fe7-306f9ad8f5d9",
        "indicator--ba371a68-24d2-4a33-b5f6-ed7f3dd5755b",
        "indicator--920d4ab4-9163-4c83-9f17-f3821b4db845",
        "indicator--dbcd0f99-e542-4518-b3c3-0ac57e3ea59f",
        "indicator--727d271b-90fd-48e8-9429-8a50187322e9",
        "indicator--9c25ae44-a2cc-43e0-bae2-adfa7e005a91",
        "indicator--29b0e902-5bd3-43f5-932a-98a3cbfa5f83",
        "indicator--2c4955fd-d641-48e6-bea0-fd1c86f13bd8",
        "indicator--5a56fa07-b040-4a09-99bd-5594eb2b8ad1",
        "indicator--87a7146c-58a6-4306-a7c0-960a44b415d0",
        "indicator--07d0cbd8-1fef-4b95-8079-de0ceb125ff5",
        "indicator--c59cd481-f288-4df4-ac57-fa276a17c98e",
        "indicator--6250baa6-1c04-44e3-8631-b01a25359cd1",
        "indicator--7a216e4b-4674-4392-adc4-b6c0cf587b2b",
        "indicator--e70c90d0-a9af-4d56-8241-d8323e299027",
        "indicator--96b9f629-7936-4bec-8ecd-646fd48e2aa0",
        "indicator--437e6367-1117-4588-8934-6abdaa4cbbba",
        "indicator--3f65e120-8a56-4310-8b2b-afde534359a3",
        "indicator--258c8ca5-1069-48d0-9b64-84944fd86533",
        "indicator--c1bfa54a-d1e4-4195-881a-3c025ad29b30",
        "indicator--0c5fe200-ab7e-4b78-ad1b-db8bb3c77b48",
        "indicator--81e6c608-c640-4889-9b5b-971c1f84efee",
        "indicator--330dca60-970d-4efa-8eb6-4a3c488b35c8",
        "indicator--420c4abe-37f1-4428-86c1-12fb791c55b9",
        "indicator--a2399ef8-50a3-4641-9606-a1ad4518d635",
        "indicator--4bc7f133-5c47-4438-bb48-61878ef2a320",
        "indicator--f4d5ee58-63e2-4dbe-8f46-b39f403dac62",
        "indicator--81fc0919-081e-47ea-8e51-63e06f7e24f7",
        "indicator--23bc2fc7-414a-4da5-ba20-c8631257a472",
        "indicator--8855f29c-44c9-4bde-b0ca-2a87fd457c6a",
        "indicator--6b66679e-3a5d-4b87-8db4-216e05d8957f",
        "indicator--31fc53a2-c87f-405e-97ea-9b6941c22ce5",
        "indicator--9224db4c-d574-4913-b162-02ad35f8f3b5",
        "indicator--796acbfa-3386-45b1-9d47-f3e000c56f24",
        "indicator--c7e4ad94-4ca6-4752-a05c-529579cc8a21",
        "indicator--b62ba837-c0c1-459d-af59-6f9f650a9fcb",
        "indicator--f52d2951-93a4-4eb0-bb4c-95d0a6be183f",
        "indicator--4ac9876b-4783-44eb-ae14-684569406c2d",
        "indicator--71dedf79-e84e-41b3-b9dc-88545a44324f",
        "indicator--ab1f87f3-5960-480c-8035-aaa76b92292e",
        "indicator--fd57f02e-a11e-4941-90f0-c9a9547b9cc4",
        "indicator--a46859e4-48ed-4fbe-85b1-5253c483fe7a",
        "indicator--077052b5-b7b8-44a8-a15a-85153cf11193",
        "indicator--499ae404-85f4-4d11-ac9a-df7c1886df12",
        "indicator--72818ad5-cd2e-4078-abac-2d222614a1cc",
        "indicator--5d7d5e3d-032f-4227-9383-bba7a8308a44",
        "indicator--6b159607-f629-4c32-aa4e-1ba968a950ea",
        "indicator--d5d95765-aef3-4cbf-8b74-d0705e247c67",
        "indicator--eb09b5eb-2982-4117-ae4a-7a091b9f1305",
        "indicator--c3e23f84-fd3f-4231-a28d-24f7434a0eea",
        "indicator--5094474f-8aed-47a1-96aa-65f310315e5f",
        "indicator--bf563fe5-008b-4152-bd3a-4043970c25ec",
        "indicator--d7bd531a-b30b-42f5-a92f-a11ddf672660",
        "indicator--9fcf6ad4-ffbc-4c0c-a259-8af07f884eca",
        "indicator--900da427-cc9f-4b84-a76f-1f6ed0b9ac06",
        "indicator--bf8d782e-2f58-4b2d-aeae-4b1c6f688524",
        "indicator--240d7019-5422-4325-93be-418eb8997273",
        "indicator--3807ee3d-59a5-4618-bc67-e25a030f2ccd",
        "indicator--61350e94-4605-4e83-b4bd-daa23a064c42",
        "indicator--481f4958-0469-476c-a72e-4ab3765ab85d",
        "indicator--254cd2b8-6af8-4ef1-8e3e-561e26f4f9f0",
        "indicator--db21abdf-efaa-419f-8cf3-7e4d63243d43",
        "indicator--fd7ff019-5078-42fd-af31-52aa21fbad2f",
        "indicator--037dc04c-fdf7-4ea8-a874-18464bcd10d0",
        "indicator--28d2ccca-7765-4b2e-9e3b-e4b964caf68a",
        "indicator--bae20017-7045-4123-87e9-8191b95933cf",
        "indicator--e080192e-88f7-4026-b7b2-dde901307c67",
        "indicator--c54c77e2-1890-4422-bcfc-5135be5b17f6",
        "indicator--75c410b8-ffce-44b0-8bbb-56992b4474d6",
        "indicator--9bdb4de3-243b-47c3-b1f3-19e517eb795b",
        "indicator--dbc1c241-cb58-443f-8354-d1eb2a3cc745",
        "indicator--6bdaf050-ed5b-4f71-8533-257d926f054f",
        "indicator--be887831-a07d-4838-8acd-1f18fa4e7f17",
        "indicator--561a7ccd-d1b6-42e9-a277-3c49596a02b8",
        "indicator--836055fb-a07f-4d63-83fa-3e8d255b3823",
        "indicator--8196bd27-8ebb-426a-a044-ab1d192ea13b",
        "indicator--4949010d-7b5f-4c3a-80e5-56c2d3f010a8",
        "indicator--a0626861-1324-494e-a59f-d076470ccf59",
        "indicator--5182a074-8d08-41e3-9508-bddc0dcb102b",
        "indicator--4dd7e0e4-b15e-4fc3-ad15-b4f2c33e96d6",
        "indicator--9ba9737f-816b-4dbd-84ad-b88e03a357b0",
        "indicator--a0bda11d-e696-448c-91a8-8850613727ec",
        "indicator--196ab323-794b-4d1f-b357-e71ddd31b9f1",
        "indicator--13e9b9cc-b00c-4bcd-9712-7b81c2367b52",
        "indicator--b7cc3ff5-2b46-448d-a30f-9943c37ca543",
        "indicator--b660c43e-d0eb-4b8b-93ac-51c11219a78b",
        "indicator--0e5125a2-fb77-45bd-b5c3-f14ee16322c7",
        "indicator--195c265c-ba6e-4c4c-b5a7-e4cb4e62e2a5",
        "indicator--932d5913-a980-475b-926c-e104684c45e4",
        "indicator--c5919236-d97c-45b3-ae42-4f52ae483551",
        "indicator--d8754914-e8dd-4922-9c02-c966adac1ea9",
        "indicator--a5344634-59a8-459d-8ccb-91366284c29d",
        "indicator--30ed341e-8dd7-4abb-af1b-fdce3b5b0636",
        "indicator--396c35c8-2794-4887-b1d3-a86b8523f076",
        "indicator--4490c661-1290-47e5-aa85-0cc072fc1e34",
        "indicator--5d12149e-8147-4b24-80d7-1d9c0be6f1d0",
        "indicator--95d29599-5886-42ff-82d3-249dbde19bee",
        "indicator--b21fd1b0-8ac3-4c72-b228-d52c7e8d58e9",
        "indicator--667de3fe-8edd-4e56-a6f6-fada9fffb200",
        "indicator--c6737dee-e112-4c44-b89a-2eaf26037a55",
        "indicator--5d711ad2-d6aa-49c6-affa-8bc4e3a11505",
        "indicator--0cc7a57d-8749-4467-ae1d-d80525db8368",
        "indicator--ec28ee9f-03d2-4c06-9a7e-82d05e381f1a",
        "indicator--3fd44e11-6bab-4835-a15e-ca53f7623448",
        "indicator--69ce3a85-0995-434b-872b-53604bf51959",
        "indicator--8fb2cda6-4231-4f22-9a82-9ce9e5b57d24",
        "indicator--cde53982-e31e-4cad-bba1-e71b24a2a744",
        "indicator--161fb842-bc55-4eac-8d31-cc06e2431993",
        "indicator--f86a49d7-b78e-48b7-a5c7-84f330fdc755",
        "indicator--d6865873-9779-40ee-ab5d-b50debb91472",
        "indicator--68ebda31-294a-4189-a0e4-4a32f4e72040",
        "indicator--91a06d74-53c2-4ed8-96f9-c54cae6c63b0",
        "indicator--2938bc43-f893-4b4f-8b91-8a7f0971ea7f",
        "indicator--175ef817-efaf-4648-9b1d-910a32ea2b7e",
        "indicator--edc05f00-7ea1-4146-955c-1d93f65eb68a",
        "indicator--bb86829c-4372-464a-b5ec-254c0e462c18",
        "indicator--b8ce3f78-d5ec-4fd6-a810-37857bf38a3f",
        "indicator--13b4d9c9-b5af-403e-9d18-7ff28081ba0f",
        "indicator--ed61e014-0673-479f-afcf-6fd1bf1009fe",
        "indicator--9f8bdb2a-ab8f-4db6-b3b5-908beadc0435",
        "indicator--146fdb43-aafa-48ba-921a-df3ad57c9219",
        "indicator--7653c9a3-06c9-46eb-af90-b2c704d59e7b",
        "indicator--f0dc03fb-1b23-4966-9013-b967f8d1b984",
        "indicator--87a81c85-ec82-4e12-b800-617430692305",
        "indicator--2c801bee-5245-4337-8190-36fe5766fbe6",
        "indicator--76560132-d912-48f2-9a94-d08a374fc5e6",
        "indicator--51a2d6d0-d42a-458e-a074-1077257fe650",
        "indicator--6f81ab7a-8b30-4823-9f4a-61bfcc0144b4",
        "indicator--7934b6c9-1b9c-4ab9-9bef-ce89d93c003c",
        "indicator--8dabf845-53f3-46d5-919f-ede9202c8113",
        "indicator--31c2cabd-a662-4d84-b230-9374a293f3d7",
        "indicator--fe33ed51-d2cf-4843-952c-94022aa674e6",
        "indicator--1d67b9a7-db26-4b1c-a619-1eb910f4168f",
        "indicator--a73cf790-bfa3-422c-8487-75bbbfa8b027",
        "indicator--4c211673-4566-4ba3-bd53-3cffd509a6a9",
        "indicator--5b338044-a537-4aca-a661-441875420117",
        "indicator--54756f7f-6adf-49bc-b930-462f6f09440d",
        "indicator--c3bd2a7c-2ab6-47ef-a34b-64af76c1ee03",
        "indicator--e37161da-a02b-4dc5-a21a-8afc0db910bf",
        "indicator--20066a56-ced1-48c3-80b3-8e792dad8819",
        "indicator--1ef48b62-787b-402f-b1a4-0182002d746e",
        "indicator--bd3d8cb6-8ae7-479c-906a-88e42919091c",
        "indicator--2d68e7fc-4ff7-4107-a49f-e9eeabebb747",
        "indicator--a6e76ae2-e142-46f1-bc72-6246c189cfa1",
        "indicator--f49b9ed3-98d7-4ad7-a5a0-7fb552a5ce25",
        "indicator--ad2d22c0-f00b-42f2-873b-7fd390568130",
        "indicator--642aeb08-45f0-4d66-9fa1-5ebeec21af99",
        "indicator--0cdd89cf-2cf2-4330-8f01-b9ba82005e37",
        "indicator--eada2a4f-a9b0-4d6f-987d-12fc1e1c999e",
        "indicator--09510db1-445a-4e4d-86e9-6e79f245fed5",
        "indicator--36ea318c-b5b0-4591-afa7-b8137578f014",
        "indicator--dbaa7b5e-50b0-4ad7-8719-f389a9bc63cd",
        "indicator--de0bc393-77af-4739-931f-649d42f35798",
        "indicator--e6f68e27-019f-4ffa-8e66-482f8d40f675",
        "indicator--8624f336-5f5d-49b0-af1b-5d957ac03a4d",
        "indicator--1dbda11c-a764-487e-88df-980ac98e1955",
        "indicator--fae62f13-087c-4606-871d-e2af03aa87cd",
        "indicator--38971095-3b51-4c99-bf05-5036f1c7160e",
        "indicator--f400af7f-72aa-4946-a704-e8443a9a80eb",
        "indicator--fc47a77c-4ad2-4e6b-9a5f-85b3f5f137f6",
        "indicator--574318c1-39c6-45e7-8fbb-6007d0dd6239",
        "indicator--b6400d11-625e-4761-a8f8-2d5e9422d107",
        "indicator--1382196a-7067-45e5-b310-0c213a9fc79f",
        "indicator--e533cbc5-eeea-4102-979a-070de9d5779b",
        "indicator--bb735259-c370-4064-8160-d91a35b839ac",
        "indicator--177aa1d6-eef6-4b58-9720-e945f6ae79b7",
        "indicator--969eecad-1dcc-4452-8198-6ad8aedbccdf",
        "indicator--432cc591-ad74-4643-92c5-96affa022791",
        "indicator--feb5e362-d129-4d4c-82fc-70fa15b2712a",
        "indicator--3cc7ea66-e156-494a-bd1c-17691371e217",
        "indicator--23f09a5d-09aa-4a71-89fa-b693bfebfe02",
        "indicator--ffb7076b-32d8-431b-9f3c-638dacbf358e",
        "indicator--792f261e-c7b4-459b-b2c8-419a272a6c91",
        "indicator--63f4c9d7-346c-447b-abd6-1bbb0fdd650d",
        "indicator--54e88eb3-416d-4352-b160-2ac9742a9718",
        "indicator--456ad23f-0eed-44e9-8f43-6cba95b36dff",
        "indicator--5f6e02fa-3444-4495-b2b0-1566e44e029b",
        "indicator--e117ac69-8fcb-417d-94f0-f2d6f3b794c8",
        "indicator--89640d6f-6b9c-42d9-a1fe-5318a4dc1018",
        "indicator--f5f73bc2-1525-46d8-97ea-860f87d654f7",
        "indicator--68d71dfe-0a04-41c5-8ac8-eecb26bd6b76",
        "indicator--6f22bcf2-5657-4a8c-97ed-f02a9cf6d5ff",
        "indicator--606927b8-5653-4d6f-8ca3-4a018249096c",
        "indicator--28701139-e8dc-4bd4-be58-27fc66f3a690",
        "indicator--eecb6b79-4f92-4cf5-bccd-4a5f5ced5802",
        "indicator--5931e912-c4e1-4059-b211-72ecb81c13b6",
        "indicator--a556cdf4-aa88-498c-b8b2-53c89dcba985",
        "indicator--6f214f42-137e-4ba8-9787-bf8fe2b8e7de",
        "indicator--41de92a1-e6a8-4f45-b4b6-5b145e20722f",
        "indicator--fe9023ff-0354-491f-89db-bccd435e66aa",
        "indicator--fa60fca5-098b-4aa5-b7bf-f0e55791986c",
        "indicator--904ff349-5cb8-4e26-a7a8-d339bef9bd15",
        "indicator--3a983507-431a-46ed-b648-cec9faf7cbe6",
        "indicator--e53f9666-a0af-4172-a7ad-91059724dc9c",
        "indicator--34801dcc-feaa-4b6d-9bff-5c72d427ee19",
        "indicator--9df0c2d7-0580-4c50-bd90-6ce624c8578c",
        "indicator--088b01b9-ce57-4a40-90e0-7f6398f6bd7a",
        "indicator--d2a8da0b-e7d9-4432-9ae3-62df93fecbf6",
        "indicator--3517c695-3a7c-452e-a618-f4d943ff0a3c",
        "indicator--1dcf459a-73fe-477b-85e1-67829d314bb9",
        "indicator--06275e4f-e0a4-4f60-b542-5816589cceb2",
        "indicator--b85ff820-1098-4db4-a62c-9154997875e1",
        "indicator--8072721b-ea1c-43fd-9529-d0821811f2de",
        "indicator--08aadb53-f162-49cc-8797-6f3025a549f5",
        "indicator--2ec5e1f2-58ce-45fb-85da-32a60942a97a",
        "indicator--79c53f8e-6b75-4cba-98af-987683b52561",
        "indicator--e2f58963-6201-4b51-9ed5-64e7e5170dc7",
        "indicator--7778318d-9605-473d-a37d-0d8aa916f2c2",
        "indicator--c8e81118-13ae-4613-8f5c-9cf4e83be1c3",
        "indicator--86cfebac-a12f-440e-92de-440f9a9d0d0e",
        "indicator--4ef98add-45d7-4935-bbe3-638f2bf8b550",
        "indicator--e15e1530-0f21-4a9c-ad71-7c4dcd070f3e",
        "indicator--a9bfd5f3-b2c8-490d-a19c-d4c0644a9cd7",
        "indicator--0040a6bc-b841-4160-ad50-8965fdee9d76",
        "indicator--4e66bb3f-c0fd-479d-86ad-27ecedfe0697",
        "indicator--b70bc937-bfd7-4829-892a-194893cd7f8c",
        "indicator--81c3723a-60e6-4105-a7cf-6cde9a1f1bbb",
        "indicator--589f59a1-4a41-4c79-a773-8606641c5188",
        "indicator--567c8256-1a96-4aeb-a615-ee326f356bf9",
        "indicator--279776ff-3c2c-45ab-8646-962403c7ee75",
        "indicator--216f28ac-ec98-472f-a2b3-f3e4fc70709f",
        "indicator--57c81971-2456-4b7f-94a5-9971c27db005",
        "indicator--3825cc85-70fa-4614-81aa-63fae8d495ef",
        "indicator--848b8b54-89e6-402e-8d6c-98cbde101dc0",
        "indicator--d5eff5f6-1807-4b92-a564-53ff8da8f8dc",
        "indicator--b1331074-b42f-4ede-8b71-c03843a95368",
        "indicator--38772244-17d8-487b-b1b1-a0191ddc4e20",
        "indicator--b311c35f-b65a-48dc-b9b9-ae03ac758e4f",
        "indicator--34f2322a-8dc2-4070-a150-524823b3f4e3",
        "indicator--c7e96d16-cee6-4ab1-8096-06e9e4477f16",
        "indicator--60063435-590b-4452-b7e0-c58309a67332",
        "indicator--5691b237-ec99-4e5d-934d-be29c5494266",
        "indicator--93f2260f-0a6e-45ed-bbdf-2218898d6272",
        "indicator--f60341cf-da5a-4c82-8b08-04b112b4dfa3",
        "indicator--bb553741-a276-4303-ae88-768156cf3545",
        "indicator--4bbd940a-9564-41bf-8ece-2340057c6bd9",
        "indicator--dafe0464-c7ce-4d58-8d55-e073a4d1a80f",
        "indicator--d89e2e59-00ef-45a2-a377-684b61219600",
        "indicator--68147502-567b-4e8b-b551-6be66d6f7617",
        "indicator--c65e191b-91e3-481c-80ae-3bf3ba9310e0",
        "indicator--50709f59-da31-4a49-add8-d4bc176f525b",
        "indicator--76583976-535d-482c-bb3e-6bedca55fc99",
        "indicator--57ab1f7a-55ab-4ab9-98f8-e74e0a090047",
        "indicator--f88a4c5a-1c37-42cd-a390-5a997bb8dc3c",
        "indicator--ca6b8840-594f-4f09-8bbf-3629c0d4081a",
        "indicator--adbccbbc-e8e6-48d1-85e8-c037e3071b75",
        "indicator--eaba8bb6-4583-4c5c-aac6-98e60234311b",
        "indicator--6873ba37-dac2-4b19-92e1-8fa54abb9ee6",
        "indicator--1185d4ee-4857-47a4-b994-7ea7f09fa468",
        "indicator--e929bb18-81f5-4737-ae22-66274ca8669a",
        "indicator--309c19e2-d5ab-4c17-a91e-53f10714cee1",
        "indicator--b2238cf4-5e78-40c4-98c1-4f0434b730e1",
        "indicator--22f8960b-2975-4921-a570-ecf590aec0c0",
        "indicator--3f40292f-2679-42b4-b3cc-867b0a230abd",
        "indicator--59a51957-7223-41b0-b581-aefdf40e83d4",
        "indicator--033a6388-5514-4194-8b67-1ff24404731a",
        "indicator--d1df47cd-1c82-4870-be16-a1671d967f74",
        "indicator--2208c053-86cf-4af3-9d0f-495b51de7c7a",
        "indicator--85d8e66d-fae4-4133-9f15-df67668cce39",
        "indicator--776807b6-aac6-44ee-a6a1-34c69d3ed8b2",
        "indicator--381ef45d-653f-4785-888d-2ef4037ff877",
        "indicator--114658b7-8001-48fb-b59b-0b35ac1b3c83",
        "indicator--140d8ae3-2b88-4b71-ac30-545f06c50d02",
        "indicator--8a1bba7a-56bb-412d-99b9-ce6d1de17e54",
        "indicator--4f5b00c3-dcc4-442b-8354-178a0e99d384",
        "indicator--4d68b9ee-60d5-43ff-a1f6-3ec69e6dde3f",
        "indicator--65e07e0d-3098-49eb-992e-9f2f44194215",
        "indicator--c4511a06-8af0-4020-b77f-5611ef958cf7",
        "indicator--b3845628-03e8-44a0-b814-05a5ee81d7de",
        "indicator--edfe4c58-433c-4cd2-ab1d-69c0ef2a7f4f",
        "indicator--c3a8f6d1-5668-4b72-85d7-22f72eff3822",
        "indicator--067bb73f-f3b1-4234-a3c3-d435b3fd53e5",
        "indicator--32133883-2453-46ad-954f-4a17b7002f8b",
        "indicator--c90e68bb-295c-433d-84ab-714f58b7d858",
        "indicator--b26951bf-f97f-48fa-bd38-0b1b51d54686",
        "indicator--5af46d8a-7af2-4ee9-a8c7-879677741944",
        "indicator--d45cfbef-b7a4-4288-9ffe-7b064b78409d",
        "indicator--d4fad27c-226d-4466-9eee-a2c134d7332e",
        "indicator--fe3c6ad1-5738-4742-8bed-26c607800497",
        "indicator--133bd63f-3897-4a3b-bf07-4eca6dcaef4f",
        "indicator--4082be19-8318-466d-a4c1-928fda2de96b",
        "indicator--d8cf2a1b-9b2b-4f1c-b96d-733e10791972",
        "indicator--bd8bfaf3-cf8f-41eb-b898-09427d4a1922",
        "indicator--db15b4d4-2881-45ba-a867-12bb6ca4d920",
        "indicator--54b368b7-6a92-48cd-a6f9-d7ada7806f66",
        "indicator--cc283db4-3fb9-4309-8b42-77eaf4f53aa8",
        "indicator--18b20513-66bf-4f88-84f0-782cc9fc1a6c",
        "indicator--52d11bb7-3dc3-46f9-85d9-35ef5272ee25",
        "indicator--6103950a-9a22-4626-b968-64466915fdf9",
        "indicator--e9518c9f-6bf5-4a3d-94e5-abd9d19dad3d",
        "indicator--4c480ba0-6f11-47cd-a06d-16a6b7968d91",
        "indicator--ba59840e-86a1-469c-8f28-cae6ba490ace",
        "indicator--046773a6-c58b-4476-a7cd-1f749f2a0add",
        "indicator--278daf4e-503a-4915-b4f9-95f9ff5bc04c",
        "indicator--348399ed-7bb7-421e-b2fb-f2f513e46593",
        "indicator--ff1351ae-2dda-4913-bcb0-59827ebfd946",
        "indicator--c9d82361-408e-4f37-a526-797f05f3faa3",
        "indicator--21d3d33e-164d-405f-80b5-003c4d6f60ed",
        "indicator--a3bfd202-9bfb-4638-99c3-b066a5b932d4",
        "indicator--91bacfa8-d322-45ee-b170-a9965e6febdb",
        "indicator--30975d7c-e9cd-41a5-8366-1728c1b602ae",
        "indicator--11cd300a-cbe3-4a04-9fb6-1f29606749c8",
        "indicator--17ab4256-2a8d-4b15-ad28-2208d169bd7f",
        "indicator--c94f60b0-0106-45ea-8797-b77d70aff7a2",
        "indicator--c696cbdf-825f-46f2-8797-1724085581db",
        "indicator--e7e3d0df-3026-406e-abd0-68b6f3333ee4",
        "indicator--f2f11b2a-a8ac-4595-9919-8ec1eb15366d",
        "indicator--412cf9c1-86e7-4c0b-9c5f-7da0a26cadb7",
        "indicator--70367df4-11e0-45c6-bfe2-b77553b3fdd0",
        "indicator--a1b9b91e-7300-4fc4-9226-8fbe96cde816",
        "indicator--a7458518-54ba-4140-9b8d-b97b97be6099",
        "indicator--e6cfc575-3091-4ac7-93cc-ada86ce9be8c",
        "indicator--edd5cc14-696a-42bb-a953-f7fa2f747bb8",
        "indicator--50b8dfab-a5fe-43b7-8355-9b7f26d4aad3",
        "indicator--d08796e6-2e0d-4623-a6e3-ae2ccd3e2809",
        "indicator--e79c11e1-9f9e-48a0-9116-47e2beab1b72",
        "indicator--a09ca5d6-de40-4a64-9c92-f59278812a82",
        "indicator--a4cad4b1-474d-41fb-b52d-295f8d1932e6",
        "indicator--3c86b5e8-a474-4d02-90d8-2233e59bede2",
        "indicator--daf37921-875c-459c-814d-f4ba7c5f0751",
        "indicator--88503f2e-b1f6-4707-b2ca-7bb6c53fcd39",
        "indicator--15710d81-0f1f-4204-9b1f-189395ca563f",
        "indicator--d4d4cfdb-4070-440a-8993-7c6a2cab133f",
        "indicator--485cf39d-1e12-49c8-826a-2b784b7fa88f",
        "indicator--da09b76c-632f-45e7-bbd2-ebd5b227212f",
        "indicator--31be608e-fadd-425a-836e-e1a2950d50be",
        "indicator--b81fbc65-9c8c-4bf6-8c79-55c555d255a3",
        "indicator--7e293ef4-3adc-47b8-8d29-40eec80f434a",
        "indicator--976a57a9-b8a7-4deb-8283-b24f352560a4",
        "indicator--0057098c-6e8d-44e4-af0d-293d4a120578",
        "indicator--d10ac882-5034-4df3-b87f-a3d19570ad39",
        "indicator--f6d3ff96-feec-40f7-b58e-c724cc00bac5",
        "indicator--e0df549b-603f-4ade-b71d-32026392849b",
        "indicator--e96118ce-0df1-44df-a9fa-07a791085fe2",
        "indicator--681db80f-d159-40e2-a842-89ba7ec46864",
        "indicator--bffd2a04-2afd-44f2-94f0-a09df72e7822",
        "indicator--3bea1757-a18a-4700-8210-f9be0f71b999",
        "indicator--f39448de-568a-422f-bda6-0cff255b4dc5",
        "indicator--50d88391-164c-46c0-ae09-8dc218dee866",
        "indicator--12269ea2-f5e2-4c0b-98a6-a6aa70453f3b",
        "indicator--34a40395-f1c2-4540-866b-6ddacdaa5cc4",
        "indicator--df616db8-dd75-45c2-aabb-992c3ade3c0e",
        "indicator--0c3395f3-dbdd-4967-9613-f3d110bdbe77",
        "indicator--e86fd562-ac88-4a94-bf43-733c9e42b675",
        "indicator--77555c80-668f-412c-b5d3-3f2874f62c70",
        "indicator--6891b13d-c090-4e5d-ab35-6d1732ed9083",
        "indicator--d1d58aa9-cb55-4aa3-b655-d7aba0e8b0eb",
        "indicator--97f44f09-672a-4d8a-b687-c8bdb3595b0c",
        "indicator--6c88d86b-983d-4eb1-96e1-b18ee893a82b",
        "indicator--a5f18802-c8d2-40e9-962e-7453f4fc06c4",
        "indicator--efe75e83-4ee2-40e5-b9e2-a378d8301132",
        "indicator--fea7e2e9-e5ca-4963-8576-40ece88d8394",
        "indicator--985c1fcb-f4c8-4fa7-a11a-dcc84591853c",
        "indicator--18062449-f1f4-4dbb-9a80-b8769d34e62f",
        "indicator--50b3c854-7538-4142-ac74-f4fae5415875",
        "indicator--9ca33123-5392-449b-a8ba-0404cebfe330",
        "indicator--6235ec52-8c37-44b0-92b1-91049c4927de",
        "indicator--579daa94-4ddc-4528-8f2e-dc06448e0987",
        "indicator--edcbbb63-c977-41fc-bc4d-e0c6ecae6a78",
        "indicator--0e81553e-613d-406c-9a7e-2812cef1e099",
        "indicator--65dd543e-3fe8-41d7-a423-cba8be817f7a",
        "indicator--8a305ec8-4a85-4445-a7a2-20fd03e8e60b",
        "indicator--65c6f814-bc89-4867-90db-88f8cf8dd91c",
        "indicator--c970b361-dbe5-467d-8565-edf481000c8f",
        "indicator--10669b83-ec11-4068-af6b-bca494f21f50",
        "indicator--4ad28a3f-bb4a-4183-9600-54a6bad7d4c2",
        "indicator--8798dbce-7a3c-4c9f-b79e-4e612fabbb4c",
        "indicator--23d05474-5ca2-49c0-9b3b-9d3a0f24f2ba",
        "indicator--05679f50-a584-48d5-9d1b-b7b8f531df63",
        "indicator--a239f3fa-ee8b-4617-b2c8-b984aaadc55c",
        "indicator--6fbe6b4f-c183-4c8e-bc6e-561a5638ed34",
        "indicator--0107c02d-4c06-4ea8-8aac-63ffad262f4b",
        "indicator--bc84c8f0-ee9f-4b03-9088-e3c2d0bfe130",
        "indicator--f7dce040-5fcf-4417-b49a-15f5213b866e",
        "indicator--c556691d-3480-4774-8081-df57d8d9192d",
        "indicator--1f2c7aa9-9d7e-45a4-9ea2-191069413b9b",
        "indicator--4aaa339e-52f5-49be-9ad6-34341f6051e3",
        "indicator--64243af0-37ac-45d2-9844-ce78c33f4f69",
        "indicator--d34c9348-4dba-4c12-9370-9bc92baf5499",
        "indicator--3756ac87-1540-4842-88b7-c8865ccc6bd2",
        "indicator--cde2879a-ac49-4c0f-ab7b-00eb4757a4a6",
        "indicator--1afbe195-620d-478d-84c2-6edcbfeaa0a0",
        "indicator--f7079745-23db-40d4-abb4-93512f81ebc8",
        "indicator--29c0a96b-6568-4045-bc47-3547cb80dbda",
        "indicator--c7473862-e58d-4215-a660-149561247e70",
        "indicator--b266d92f-15fc-44d0-9c66-b87b34d86e0e",
        "indicator--5aed1181-07fa-410d-a805-8e7014e7dbda",
        "indicator--ba11d90f-df8f-42a6-a3e3-bcd40aa7a5a6",
        "indicator--7dd89862-dd45-4c0d-a974-3f23e60c0049",
        "indicator--0edc176f-fa7c-4b58-a37e-30e27327112d",
        "indicator--efd45722-c0ea-4d7f-820f-22a23717fda0",
        "indicator--db91ed01-60c6-43d7-a84a-b383ea6f83ea",
        "indicator--b83a3310-e5fa-4462-ae74-2625d1d3fa54",
        "indicator--5196be21-fa53-420d-9d02-2f7501aeed07",
        "indicator--d9e7b475-cf85-4410-8b5c-e209c7bc2516",
        "indicator--faeb6f58-1307-4271-bc21-35d35925925e",
        "indicator--ec9bf603-c7e7-4c35-b058-331ca6732142",
        "indicator--4c0a4259-0eb0-4e9f-8450-c146485d377b",
        "indicator--da315a0d-3c18-49cd-bbd3-f125de8768c6",
        "indicator--4d2b306b-24f7-4d70-a730-13120db63d1c",
        "indicator--f41364bb-ad08-4672-a3ce-db472a94b7a6",
        "indicator--b965f4b7-8842-4600-9f71-b8b664a58ab4",
        "indicator--e8b4d565-5387-45f7-ba0e-ca2901cf54ab",
        "indicator--6091034e-0ce6-4759-96b6-9a7ecf2f2e8b",
        "indicator--9ce5aae5-1bb3-4fc3-90f5-0e88c955ae7b",
        "indicator--92f369fb-5c19-4c0e-9a7b-b81abc564c99",
        "indicator--2f840cdb-e7b8-445b-9c50-9551c9926075",
        "indicator--d562f7e2-5410-45aa-908f-18b64283f0b1",
        "indicator--d2f1c257-33a8-4a4b-b652-f2f46edc3db2",
        "indicator--eeccacf6-1498-47c2-8478-ec5a5cd0b490",
        "indicator--0447e8d7-49e4-4ecd-94b4-e6750799496f",
        "indicator--396204da-e0ff-4ef1-9f8c-dc84fc653957",
        "indicator--00a64800-7b0d-4ff6-882d-7f054edc53b4",
        "indicator--bde96bb2-b68a-470c-a777-868a2b18f1ea",
        "indicator--3e0129f8-5efa-4de1-9aec-04f56c1f36ba",
        "indicator--d551cb5f-4e96-4cd2-9545-110e4f8b2707",
        "indicator--f3ab0309-0fdb-46e5-865c-4ed319d6604d",
        "indicator--81184338-fa46-4621-9e5b-d94002e351f7",
        "indicator--dcc0c787-3972-496f-99be-8a90d75bb601",
        "indicator--b220cef5-bd5b-4f4e-abe2-33acd7ea592d",
        "indicator--451acd4e-069a-4ecd-a517-8cefad942d4c",
        "indicator--47f7ff08-748a-4508-a310-5bb29cf3b411",
        "indicator--1747c551-180d-4a2d-9d17-73082d78f5ab",
        "indicator--94a17d3a-e1f1-48ae-9b9b-ccd3a781a501",
        "indicator--379ba695-7063-4fd2-bf2e-4262a9044585",
        "indicator--4efbda66-a53b-48ce-b006-b54d5d8c9ffe",
        "indicator--d04fe5e4-7383-4804-8ea9-1c100aea6c82",
        "indicator--d6b05923-a248-49c7-b504-461879d82672",
        "indicator--77721d07-d627-4720-8fa0-51287d01d1fc",
        "indicator--ef0c1e4c-0c86-459b-9fba-9b16471c50c8",
        "indicator--fa667f2a-d6b1-4cec-9c1d-e9c2503e6092",
        "indicator--92b4bb19-b945-4a65-9619-1eeb7d375656",
        "indicator--1c0afb5e-6b4b-4c39-ba10-7b94c4e3407b",
        "indicator--a3d2dbea-1bd5-406e-82d9-389f816659d2",
        "indicator--5e8aaf00-8daf-4700-bbc5-ea466de60760",
        "indicator--17ba4860-9c3e-486d-a81f-2ddeb73a1f53",
        "indicator--c0282d67-4686-4675-b524-bd125b96a731",
        "indicator--d12d9ff9-3630-45a6-8043-e9034fc29218",
        "indicator--07879074-155b-448f-8625-3bc048cf69e1",
        "indicator--744206bc-16a7-4584-9e1d-7eb740ea3197",
        "indicator--3cfcc4ee-357c-42c1-a79d-d4a5714136f4",
        "indicator--69f343a4-29e6-43cf-b25c-a097d65658e4",
        "indicator--d82c6ada-b262-4daa-991f-952156914ba1",
        "indicator--ae027052-7b83-404d-9c64-21036a92557c",
        "indicator--7d9dba6b-cbcf-48a2-a454-785277d3d108",
        "indicator--2fb22ffe-9119-4ca0-862e-975cc4d4791d",
        "indicator--84b03f10-f707-4076-9b4f-5b3440814918",
        "indicator--c5384f8b-7201-417a-ade3-e8e3f12ae11f",
        "indicator--b66f61cf-0654-43c2-b3ad-449f795af908",
        "indicator--87b5a0c7-d754-45aa-9483-db2e5982818b",
        "indicator--0a6811e3-001b-4043-94b3-334846186134",
        "indicator--c185f73f-694f-45b4-a937-cda405f8ce5f",
        "indicator--1593592c-6a05-4805-93e0-d922e3e9d749",
        "indicator--514d225d-c059-42f2-a6b5-cb28e9eae9be",
        "indicator--89da240b-e8cc-4894-9028-f2cc8a838996",
        "indicator--3354585d-026f-475b-b1be-e4eac16cf16d",
        "indicator--1d463952-667b-4259-83c5-de0284fbcc17",
        "indicator--442981fc-a85d-44f2-8608-8aa373dd0fc8",
        "indicator--db6e29cf-f35b-40c6-bab7-c5c801aba30d",
        "indicator--923d19fe-712a-4a0d-b60a-c5d6be9a47e1",
        "indicator--adaf91a8-56a5-4a05-b894-0973b2aaf90a",
        "indicator--ff9acfa1-6970-4bb4-989f-e56b6ab5a200",
        "indicator--823d94f7-ab3e-4c98-b60b-23003e91ffa8",
        "indicator--2bba9d1c-d5fc-4539-9122-ff40317401ac",
        "indicator--ee9b3f54-2549-4b79-8996-388322d80c2b",
        "indicator--ee429386-7130-44f7-ac14-0f781c78abf2",
        "indicator--6835e72c-6bea-49c4-9430-50478c37af8e",
        "indicator--a9d768c8-d53b-40eb-83b2-8a68fd9b7574",
        "indicator--51679603-b334-4388-a985-ff79f2725d6a",
        "indicator--6d9aa3bb-48b2-4d30-8cd9-d483f6c43236",
        "indicator--da6a0f4a-8aa7-4bd0-ba67-a60c1de5e948",
        "indicator--9b9c2580-29e8-43ab-8e49-fa66a4c7f69b",
        "indicator--ad000853-72c5-4a33-b487-557e5ad60bb7",
        "indicator--b16872ed-3523-46bb-8d03-d598d0cc3787",
        "indicator--d0b4fa51-59d8-4194-bfd6-8527355aa3b0",
        "indicator--47a16119-fb6c-4ab6-842a-247316e74d1d",
        "indicator--090dee18-e1ec-4d7e-a513-0b8bff423821",
        "indicator--da78b1c3-24c7-4fe6-a46b-438cbf8d6911",
        "indicator--fc0b66ce-b944-4f4e-b2de-5523c143b718",
        "indicator--4037f2bb-b33a-49a5-81f8-237168a72cd6",
        "indicator--5056c6ae-ce2e-4820-9f64-32854e4a7a91",
        "indicator--cf4a1081-6cad-4bd2-b4a2-e92190518035",
        "indicator--21074945-e39f-4682-a101-86e7a9947d8d",
        "indicator--183d1a2b-f451-4c4d-b26e-64e4b19b1468",
        "indicator--0b941f9d-076a-4fd0-9664-79149b4a0c61",
        "indicator--81b50391-9d27-44a6-9dda-7613deba14dc",
        "indicator--506fe066-f4a3-4a90-9c8b-b2250876e9a0",
        "indicator--98ee8471-a8b1-43f1-a553-64e1df1622af",
        "indicator--be5eacaa-6666-447a-859a-4233520a3697",
        "indicator--cf5f2317-7e04-461f-ba9a-fc2242fef800",
        "indicator--cded6b0a-f596-47f4-bb89-8d1d9360182c",
        "indicator--9a09aa7a-f8dd-41fe-a59d-8bc83242f6eb",
        "indicator--76a13089-7004-4317-91a3-989c7679ca46",
        "indicator--4bc6866c-c3c9-4ec6-a885-bd01ef060446",
        "indicator--d3e2c5d1-cc21-4428-991e-919b940b7a7b",
        "indicator--bf3c24ca-bd67-4bb3-af86-512b0d4bcac1",
        "indicator--17b1284c-f040-4613-afcb-7ab21d9579aa",
        "indicator--4cfbed3f-9213-4ff2-8772-f4306cb1f465",
        "indicator--5d0b0d66-81cc-4e69-89d0-96ab04627ad9",
        "indicator--4f324b61-93e0-48d3-9d87-48026d2f0d87",
        "indicator--2b804ddb-f7b0-4f38-bad0-6746bbe33948",
        "indicator--db329ae1-50ed-429d-870f-9396506efeb2",
        "indicator--22bc5897-5bdb-4720-b4e9-90dc03f8452d",
        "indicator--b6a78597-9b00-472b-be3b-9916517e9286",
        "indicator--9e78cdfb-3e68-4013-b1be-fef92e551c4f",
        "indicator--8eca6ffb-91f6-4b2e-b7be-607d2c40a86c",
        "indicator--f4752e5a-3ef8-4cd6-81f7-d8a42198c84d",
        "indicator--186a8949-4ef5-4d82-8158-a375d9929765",
        "indicator--ee2de3a3-2a4c-4d89-bb39-b2d05fac3195",
        "indicator--18b4d64b-c946-418c-bae9-a102d25119cc",
        "indicator--f6f983e7-79a7-4b90-8bba-ea4901a553c0",
        "indicator--4be0ae6a-e9a4-45f2-ac26-f80b302ff962",
        "indicator--c8219fe1-8e76-4cbf-b236-1b63b9871bc6",
        "indicator--ed801a98-08bb-4882-b84b-14d9af536dd3",
        "indicator--1e8ba249-2214-4792-a442-29b77f116282",
        "indicator--c562fba9-f600-4509-8334-a3fd2d0886ee",
        "indicator--0f33f29e-14b2-49de-bade-13032de20d8e",
        "indicator--5a8a78e7-0036-44a8-aff3-6c606256a2d6",
        "indicator--572e95c2-c7be-4a9a-a960-1d69a4968d48",
        "indicator--092eaacf-ea8a-40e3-91fa-3ea31833a6fb",
        "indicator--ea6fa25f-39c7-40c1-9de6-ef3cde78eed2",
        "indicator--a53ec823-0bfa-4aff-a5ca-fb5564eea532",
        "indicator--37ae065c-4338-4a81-b2df-f98eea18f855",
        "indicator--568d6fd0-0c16-494d-9205-3633aa52369d",
        "indicator--b264fe39-9769-4fb6-ac0c-f60ccfd65736",
        "indicator--9dccdd5c-6537-43f2-a60c-c530277cd60b",
        "indicator--3b91acea-20ae-4ef5-8449-b423c2a225fc",
        "indicator--357b747a-3123-40a5-9712-71aca078db8d",
        "indicator--10c43ed6-870d-47bd-a497-4e72677f18a7",
        "indicator--56eae437-1f42-44a8-b2c3-27445083f518",
        "indicator--be6a867f-8da0-446f-8208-dfeccd9a1fc9",
        "indicator--fb59e99e-f68f-4939-b0c7-8a18a7434d6b",
        "indicator--4108de56-5e88-42ad-9df7-00cf06b5ec27",
        "indicator--61762fe0-957b-40e6-a104-c15d2a262349",
        "indicator--9f767ce3-84d2-486c-85a4-d646ed74b56d",
        "indicator--2eb4ea58-51f6-48ff-84c6-6dd2e4f7fedb",
        "indicator--a984b872-95a1-455d-9c2c-332d97830e86",
        "indicator--47e2a0e1-1286-42ed-a2d6-6f346ef20c7e",
        "indicator--5963635c-4ff2-4604-a6d5-2526ce7751a5",
        "indicator--f0f89929-7e42-4d67-a724-a44df9fab1ff",
        "indicator--14c0a172-ddac-44c8-b396-5ddf960e374b",
        "indicator--2027d027-5d41-47ed-8c3f-fc9183f71dfa",
        "indicator--7121adad-2c08-49a1-a967-798de977b2de",
        "indicator--526f3a43-20d1-4973-aa2c-a8c51123cc05",
        "indicator--d6bfb613-1de8-451a-8cf2-accaf6e90ae4",
        "indicator--3811e9e9-7290-45fe-a0d2-99a523c61266",
        "indicator--72a0b69a-5406-4971-bf0d-54b13ab3b954",
        "indicator--a8661e6f-167c-475e-9e2b-ac76b81e5b54",
        "indicator--b79cde4a-7520-486f-a6e2-265097065b4d",
        "indicator--2da1b27f-59fa-4a86-a814-f750e4f71fcf",
        "indicator--81992fa7-991b-455f-b168-683d8b2b96b4",
        "indicator--24bc8686-78e6-41b0-905e-754f130ccaf3",
        "indicator--80245ad1-b035-4256-adb5-7662512a34df",
        "indicator--4f97f50e-4c6f-432b-a0f7-9090aff1d10a",
        "indicator--8760a107-7544-4bdb-a520-91125ea41e1f",
        "indicator--dd19fa6c-bc44-48ec-9ac2-b162ab16d8a0",
        "indicator--e906fba4-af67-4397-aa49-0dd5c7e9fd0e",
        "indicator--3031174d-685c-47cd-8a0f-10fb80c13297",
        "indicator--36d9191e-13af-40e0-9a9c-694b8d7f3d6b",
        "indicator--98202337-4317-4256-8f53-da27178d7395",
        "indicator--4922af1e-b81b-4f6c-85cd-5e188b20cf88",
        "indicator--5ba16619-00b5-4137-89fa-b06319339c20",
        "indicator--539900c4-388d-4e90-93d9-c56e65f94fed",
        "indicator--ebd643ab-9094-4065-a17e-9d2473b1fbf4",
        "indicator--24d28e71-9c43-46e6-9051-227d646521e3",
        "indicator--01961c45-c9ec-408f-a827-cd12be5be9dc",
        "indicator--e29ac8e7-16b0-4ce6-a220-f8e08b607afe",
        "indicator--f5a0aaf3-8dc7-4464-be88-fb2ac34c4261",
        "indicator--fa7bf9a0-136e-4a4a-b671-894b05844784",
        "indicator--8b844399-f00c-4ebe-9907-be39a9303ba7",
        "indicator--a53d33d3-ee15-4a6b-a2f2-54f115e6e4c4",
        "indicator--b8182c66-c5ea-4ddb-b122-fd002d043364",
        "indicator--6d22ab3d-9c64-4ee4-a0bc-34a9fe0ccdac",
        "indicator--9c44980d-c47c-4ecb-b9b4-65a4a178ac7b",
        "indicator--c6f33ef5-4977-4740-be9a-3eaa05754aab",
        "indicator--7677b7b1-4a75-4447-a10f-d845ffb39820",
        "indicator--96eb34c6-ae75-4e33-9ed0-0e5201e7abfc",
        "indicator--21610cdd-2b73-4c4d-baa0-96c23e092993",
        "indicator--9e52a1a0-7a27-4a2f-930c-29eb52287ab0",
        "indicator--861b8ef4-c890-4df0-a746-54a8c631ebfe",
        "indicator--e48b1240-f50b-4dd1-be4d-7477cabe26f0",
        "indicator--a7ae4174-9a35-4225-afe4-342e74751a0c",
        "indicator--900efc71-68fc-4f33-b6fa-5e5579c938ce",
        "indicator--08934c6b-322b-46c1-bffb-14f7f949d41e",
        "indicator--c4e7f782-af16-494c-a392-f113370297bc",
        "indicator--b6818711-d4e8-4395-81c7-5b1fbf9c1403",
        "indicator--2c6c8066-5639-4561-b0f5-3dc09bea9855",
        "indicator--6d7e56c3-70ec-40f0-8b39-9e7428175984",
        "indicator--315833d5-a406-42af-8658-37a838c393b9",
        "indicator--a1155fbc-6960-490c-9622-8310691223a6",
        "indicator--5b5c7b65-2ef0-4fd4-8cee-249ed54ba896",
        "indicator--99f48fc4-fdb9-47ff-bff6-12db71f757ad",
        "indicator--87fe8501-c4ae-4d8f-9734-f7fbf5d6d2fc",
        "indicator--6a78b2b8-efef-4baa-a845-cb5983d8b44e",
        "indicator--efa66c1a-ce81-4e68-a640-e7e1d931adca",
        "indicator--6371437a-b1fa-4b66-b2ff-eb158b46c715",
        "indicator--278100d7-42f3-4bf8-b47e-fd9341f39119",
        "indicator--563081ad-ca09-4901-a822-294afba1149c",
        "indicator--a0e92841-11c3-4ce6-ac97-d600b6224a7d",
        "indicator--1fa58f1c-0b14-4485-a9c5-a1fafcdb1ce9",
        "indicator--e715863f-9733-495e-9b4e-cd91563c47e7",
        "indicator--a7134134-8d80-4903-aee3-0ccece08ade5",
        "indicator--9c9a0ade-e06a-465b-8ba2-1fe732aa2b8b",
        "indicator--5416bf83-23b8-4ad0-aa8d-6f1fd4a465e4",
        "indicator--bcd374af-f6b4-45fe-a70c-d83200b497d9",
        "indicator--8dfee77e-4063-4ab7-9a72-097c4a1fdb8f",
        "indicator--98c85f96-9b85-4949-9512-9681dd2b382a",
        "indicator--838ab9d6-891a-4006-98e3-128cd8eededb",
        "indicator--bc03444f-4826-4130-b08f-5d15eb547874",
        "indicator--d116ca4d-63fd-42b1-a215-79535e4c232e",
        "indicator--ad96b81a-c723-48fb-aa88-0690f27d5ff5",
        "indicator--ba6b3a06-f193-4d36-8c9a-6c9616225651",
        "indicator--8614d17a-468a-48b6-8b50-d3e992e33447",
        "indicator--00b1630f-bd70-4279-9897-4b58c9b503c2",
        "indicator--87255ead-4d76-4a41-8079-9491b8273b5c",
        "indicator--ee2d6adf-46c6-404b-b6bc-efa431ea15fa",
        "indicator--fcb667a6-c5c5-4d42-b922-be26abaa4df6",
        "indicator--09cc842a-b33e-45ea-8d26-d823d2d208ee",
        "indicator--7f209375-f723-4c70-93ad-ee8fdc3ea965",
        "indicator--e2add2ba-aee4-4ed7-996e-a0775a560d30",
        "indicator--9a739eb7-f862-4cad-9abd-ca06832485d1",
        "indicator--122e0e20-454e-4ec4-89eb-ffa98fb168df",
        "indicator--d2f52842-5c21-43c2-a0c9-375760a275b4",
        "indicator--6ababf7d-db2c-4b18-9f01-4247f404e35d",
        "indicator--ac2236fd-2eac-493e-b6ea-8fb64821c633",
        "indicator--b364ebeb-dc38-4c3c-8423-d3908ef6112e",
        "indicator--68ef53ee-dfe4-4442-8bde-1b81e1f101de",
        "indicator--be976e5c-7f61-4ed2-a6c0-110130d4cb95",
        "indicator--3891d9a3-0514-40f9-a1bd-3d192f9fc82c",
        "indicator--1305746f-6681-4f93-be00-9ea184470da5",
        "indicator--d77e18de-de89-476e-b91b-c80f331c3f39",
        "indicator--2d571f8e-14d9-435f-a6d0-21be1b4c4777",
        "indicator--ea62c971-51a3-4045-8f4d-e39a8aaf5b12",
        "indicator--13b1f9cf-73a7-4b9e-9c7e-0b914a404565",
        "indicator--294346e2-c933-4195-9ed1-86a407fd1097",
        "indicator--d44611ed-e469-4c1a-8178-f6ffe830b310",
        "indicator--531603ba-b99f-488f-b833-0d6a16bc6d49",
        "indicator--7330c72d-a585-4b4d-848a-f43b86826036",
        "indicator--df92b265-4aa3-40ba-8564-523dab4871bd",
        "indicator--af42ead1-f2c0-42f7-a019-a64fe05a4d08",
        "indicator--b2886c1b-05b3-4600-b9ee-c5502e33cd19",
        "indicator--5cdd0a97-7dc0-4555-9776-fbc07235f429",
        "indicator--f91d21b7-69bd-4ad9-a260-dd2f0b76dfb8",
        "indicator--94a4bcf5-bcfa-4650-b7b9-f7c237e21502",
        "indicator--d22f41b1-fe71-41c5-a8fb-a8e3a3df0eef",
        "indicator--d0b612a9-a934-4a11-baa3-ba071b3c0510",
        "indicator--a071f222-f622-4686-983a-3955b0de2df5",
        "indicator--12369dce-846f-4287-ab34-02993b717d9b",
        "indicator--367fa495-92ed-4cbe-8c55-607e27a4fb93",
        "indicator--a6953111-d576-48dc-b6d2-79b6242b3c21",
        "indicator--d3f5c91d-74a2-4ea9-b86b-2f470d8f9923",
        "indicator--5c430835-069b-4af6-8c54-cfcf28904510",
        "indicator--78f24f92-2a2e-49c1-b201-9c1254304cd5",
        "indicator--a952befb-190b-47b0-bc62-24ef3da04d3b",
        "indicator--1b79ede9-1a87-4010-9baf-650cace14757",
        "indicator--af7a5357-ec4d-4f38-991c-fa121b725e2d",
        "indicator--04834c98-151f-4964-992c-f8a8eacef831",
        "indicator--fda1da40-ebe9-412e-bc30-c572c3c6ff6f",
        "indicator--56945d45-42e6-4288-92b5-710b2817ecb0",
        "indicator--630544ce-7b19-461e-af3b-33e145e4353f",
        "indicator--94fdc1fc-acbb-4302-9bde-d59303c1039a",
        "indicator--75677e55-2a7d-4c11-a9c7-77b5a168a179",
        "indicator--fc4c0c24-dc83-49b9-a7bd-efcf1a74c446",
        "indicator--f8f3e1b7-88a1-4adf-a1af-224027e479b2",
        "indicator--15bc4f70-7821-4729-853b-6c383945791d",
        "indicator--7f20472e-38e7-41ac-8153-af9865525616",
        "indicator--c0cd6cee-8f7a-4443-a8fd-84e325638d01",
        "indicator--0c571e02-68f9-4713-a4a6-3e737082155a",
        "indicator--0ceccc98-5a2c-42e1-a463-4bbb782ea621",
        "indicator--47b41402-de3d-4945-ab96-0c2479621170",
        "indicator--7ca1c572-748d-49bd-986f-be89393192ec",
        "indicator--1617166b-e86f-4197-9904-4d2a12450fc5",
        "indicator--223d229f-b153-4023-8caa-4f4a59ed5ef6",
        "indicator--468490fe-c298-46e1-88c3-4091b87793a4",
        "indicator--495c5b1e-d3e7-4ebf-86fc-2f3fe6df822d",
        "indicator--2934f570-a0e8-459d-869f-23d34bc81ad2",
        "indicator--e14d2941-9e09-455f-be46-e07dca5499fb",
        "indicator--dce9b5e4-e348-4cbf-b58f-ff91cd534f64",
        "indicator--a189593b-b8ae-463d-9910-b90bf207c19e",
        "indicator--bc0c9f7c-2dc3-48e0-ba8e-f5a2d78cabf6",
        "indicator--829c00a3-3525-429d-8dcb-891f17344f4b",
        "indicator--c56ac78e-42bf-4d1f-8285-d48613a661a6",
        "indicator--0066859e-1809-4201-91b6-44b2713bfc83",
        "indicator--8328a6b3-017c-42de-b818-3fe4e81e5a19",
        "indicator--f9b8e5e1-7f5a-4ca5-a178-d1b339c4f038",
        "indicator--d962f10c-29b2-4942-a11d-9ad3afc585e5",
        "indicator--20bc6991-022a-499f-a895-fa8efa90803c",
        "indicator--61854f01-6bfb-4d3b-a971-b2b6d4bb82b3",
        "indicator--a9320f2f-cf63-4eac-ba66-6f4528c275b0",
        "indicator--170790b2-a92f-4f8e-afbb-42a84bf8ac95",
        "indicator--62269cbd-b60d-494d-9e82-2d9bb8743a8f",
        "indicator--3c090931-39ff-4ef0-b774-bedf43a8b305",
        "indicator--ca38ee80-e49e-404d-aa40-dfb93b0d6f06",
        "indicator--b45533cc-4a62-4042-b6d2-e4b794eef3e5",
        "indicator--d492265f-4c50-41c1-88db-72f561c80742",
        "indicator--b904e24c-c26e-4d46-ab0c-afa0de34bbd1",
        "indicator--fed6e4f4-8862-49b8-a249-8e28e58bd308",
        "indicator--61b4f97f-0dd4-4358-b138-d76bbe9f83e6",
        "indicator--1f020564-3b8e-4e84-863d-20b222af760e",
        "indicator--a739dc8d-86e9-4da0-9bb9-759ec09f5bb0",
        "indicator--61c2212f-108f-4a6e-b8ba-9092470f5423",
        "indicator--05d88a63-de14-4914-aa56-9c10af3d3c15",
        "indicator--f5a06fcc-bba3-4b3d-a529-d4720a9c6fab",
        "indicator--24213a70-2556-4fbe-8a55-6ca7c8c97ac9",
        "indicator--dd67f146-9fab-4b29-b178-3f9d94ac550f",
        "indicator--335ba962-161f-4936-b422-1aa824bfc4cf",
        "indicator--3265cdb1-ad93-4e15-a56b-f9a645f1916b",
        "indicator--d9045946-83ad-4432-acc8-64fedeb4da8a",
        "indicator--9f24a41c-a86f-4421-9188-fec5419f3950",
        "indicator--bb1a1ebd-7b65-4b82-a44b-83d0452499a3",
        "indicator--366fcfb2-1aac-4d2a-bf4c-f03f882c942c",
        "indicator--6f28a15b-b93d-4dc2-b5a1-fa9e00477240",
        "indicator--ead2ed66-25dc-45f5-b6b8-662ba9e06935",
        "indicator--aa9925e8-0dd9-4528-a99f-1f230dd55022",
        "indicator--37ea87a9-7096-4771-b54a-f7d82a80fc5c",
        "indicator--298c9895-4d5a-420f-9731-dcee96b62c85",
        "indicator--cdb60703-ebca-429c-a4a9-e0fa50389d3a",
        "indicator--2dcb33ac-168f-4545-a9ad-2f1123c68a9d",
        "indicator--f364dbbc-4fa9-4153-86fe-cb7c49032ac0",
        "indicator--a15af852-5deb-408f-9f9d-acc17ab753c1",
        "indicator--e0b0ce70-ab86-4dd0-b235-14c74d36cd69",
        "indicator--32b39aae-4a43-4089-aa48-d1e41fb7db63",
        "indicator--1167d666-2544-4b6c-9714-3a64b9587753",
        "indicator--048d1db3-e15b-4676-bb2b-af1626886e8d",
        "indicator--cb0e5d61-8f5d-400e-b24f-b4c068e007c1",
        "indicator--20b48abe-f78c-4afc-b3ae-480a26a5191f",
        "indicator--8425456b-dd07-4abb-94d3-1fc57d90ce45",
        "indicator--24a6ed5b-7080-4516-9e79-8bba6c0273e8",
        "indicator--e77ec328-c2d2-4895-82d8-0e187c40d32b",
        "indicator--a12ae7fd-bda2-4d77-933f-33e8334ac918",
        "indicator--02bba0c9-226d-4421-a208-a5c26ee83d24",
        "indicator--858fa6e3-5df3-4729-b77e-7989f7a6dd20",
        "indicator--574e3ea6-25d1-4e81-803b-b6dc7714bb14",
        "indicator--b49141f3-d7e7-4f7b-b1ee-f1ef1d3904ce",
        "indicator--7e2be634-ae49-4fe2-b3e3-fdcceed64746",
        "indicator--7a7534be-d5b2-4eab-bd38-d685a217276f",
        "indicator--72f50112-7db2-45d3-8ad4-3ed18c24787d",
        "indicator--0e6f4557-bab7-4315-a42e-6d2ed61ed4c6",
        "indicator--1ebb64e2-8bf5-4838-93c3-ba652ec1cdbf",
        "indicator--c119702c-2f0f-45f3-a635-2f3a618375b3",
        "indicator--40b41990-12ce-42de-8e33-4351d78c5ac4",
        "indicator--a3908727-dbaf-4db2-85c7-b4cb9b9feb49",
        "indicator--b81e65de-3473-4f1b-8d9e-2153d1915435",
        "indicator--9bcb2f05-0c4d-4bc1-96d5-5d191d4dc5b2",
        "indicator--e1e268cb-85da-49ee-927f-97de933ed104",
        "indicator--9342e684-8beb-42a7-9e75-5024d1d60c60",
        "indicator--afca8ae5-4ca2-4a20-b0a8-2788ba284969",
        "indicator--b605c88a-858d-4d8b-8603-5d432b4ed368",
        "indicator--92da88d8-0b64-4801-9238-004f1e1887e4",
        "indicator--9679de4d-3fbc-497e-a138-4f2a5ae5ab81",
        "indicator--f2e0d695-1efb-4872-9903-6dc590872055",
        "indicator--7d8cf953-9e2a-4284-8d4c-ff6fe23a99b5",
        "indicator--41c02dca-df06-4ab4-ac6e-158ef48c106e",
        "indicator--e2d2c126-cf06-4835-849c-183131a1b723",
        "indicator--dbf6c579-efa9-4305-be6c-2c87f954d59c",
        "indicator--3c234710-502b-4f95-b70f-167bdcf599fa",
        "indicator--fcfc1e0d-0410-4991-9783-d3bab88da479",
        "indicator--c2c267df-435f-41ae-97cf-2d50e56766d7",
        "indicator--bac3316f-2f45-44c8-979e-4f9ae1c4c51f",
        "indicator--8bf5a8b9-f792-4f98-b347-fc94c3ef6e0e",
        "indicator--5b1b802f-e04a-4b97-ab45-fb174480c3bc",
        "indicator--58153ae2-ec6e-49d8-88ad-2272b7ddafd2",
        "indicator--30f94b75-da7a-4498-b5c1-f29968bdc7d9",
        "indicator--3cda96d9-55ee-42f4-b948-33fbc734717a",
        "indicator--37f80b0f-3f56-48c5-b0e6-85db0e6cae52",
        "indicator--40bbb763-3eda-4bfd-8262-3fee2d96bd77",
        "indicator--c6dde758-5beb-46e0-897f-09f58d6fc3f9",
        "indicator--623620d5-b9be-47dc-8083-b4c4381f431f",
        "indicator--4cae8e00-6374-47f8-8ea4-2131a3692116",
        "indicator--7dd6d80f-c28c-44fd-ae51-24a89748ff7a",
        "indicator--1b4ab715-155c-438b-a6c9-dbf3cddfc88e",
        "indicator--1284dfe8-8919-4764-a6dd-c56c2734c261",
        "indicator--47ae71a6-bb97-460d-9340-9c7b67722793",
        "indicator--213bb2d8-8c08-47d7-8ec2-8c323dc58436",
        "indicator--14febb6f-7b68-4a3c-9d38-5478f8ffa2f0",
        "indicator--afb3b5f6-d5f8-4862-bf8b-8cb4d3b1a378",
        "indicator--6301f74e-0ac0-4830-9bf5-d5883e05cc0d",
        "indicator--dc1b93c3-dd1f-4125-acee-9e5145e983cc",
        "indicator--6cda5f80-c39d-45ef-a40b-37a789b30b6a",
        "indicator--9efc7aa3-38f1-4111-87aa-88ab9df18ab0",
        "indicator--19220024-6538-43b3-9674-67a5bfb48e82",
        "indicator--c75f5408-9d18-48b4-ab9e-5578c620d663",
        "indicator--414bd078-d019-463e-886c-706af1e14706",
        "indicator--8fffe8e4-edc5-41e6-82e4-cf3b8fcd2df6",
        "indicator--e87370b5-a40c-4dda-b7a3-79eb8c13519a",
        "indicator--af2e0c96-e532-4a72-800b-97aef2a2d6b0",
        "indicator--375bbac7-8d08-412d-b3db-8f04f737243c",
        "indicator--15a64419-a669-4da4-8083-ea0e0bb8d747",
        "indicator--749c94b2-8357-4623-b887-b80713402e5c",
        "indicator--b89711db-d043-4b8d-a6ca-2bd707434a0d",
        "indicator--afc6b207-6083-49f1-b61b-262f098ff38f",
        "indicator--7557c13a-9e93-4176-b65d-65ec9cac8184",
        "indicator--b20160a4-9b16-4bda-b1c1-3fd77abad7d0",
        "indicator--51c1cbaf-2227-494c-8518-4607eeed1086",
        "indicator--59db7695-09bd-43b9-a715-15213eb065c5",
        "indicator--4761c681-5330-4664-997a-1fa024b31f9e",
        "indicator--84855b8b-7957-45f2-a250-bb1a67064695",
        "indicator--f7428359-2e75-4bb1-b4b3-a1deb54a4a60",
        "indicator--58b45796-5717-4847-a33d-0405c224ab78",
        "indicator--78b36540-ea30-4a2a-8821-f21a28877b41",
        "indicator--c250564d-85cf-4391-af57-4e66a4d269e6",
        "indicator--bed5125a-fb38-4077-b987-6919a92735a7",
        "indicator--7334991a-9df3-48cd-94f9-4a05ea0dc21b",
        "indicator--b6b3d625-8c94-4d4c-8f81-90e2a6dc2973",
        "indicator--f4a30457-e76f-4841-9c07-f560d7f73c66",
        "indicator--063373f2-1573-4e8e-ae68-b4e4160d5c40",
        "indicator--0aa77709-ecaa-44e3-9d54-34444ef563e1",
        "indicator--a4b4ef22-c895-490f-8d1f-5cfc1dc417d0",
        "indicator--d8f58dab-52c3-43d3-bb9a-3724a3ebfa54",
        "indicator--703cbe1d-3d51-427a-965e-4cd111da2d6a",
        "indicator--70779bd5-a1ef-4c42-a284-efcdff2b2642",
        "indicator--9e08cc7e-0ef3-405f-9d9a-15a0ad89434e",
        "indicator--3ac1c897-bbd5-4d34-b9d1-a3bb27298e05",
        "indicator--e4dc064e-0c84-4744-9fb9-98914006340d",
        "indicator--84078a98-4772-4d50-951c-ba36b7cbf7a6",
        "indicator--cb6dfcba-6d98-45e4-b153-5a371f003786",
        "indicator--20dea4cb-c3fe-4373-86aa-5a1d45490bac",
        "indicator--143cb120-6321-42a5-bf90-b932c685b649",
        "indicator--fcb19b31-6cb8-4026-a1a4-a35c870cd913",
        "indicator--a411eb06-7d5d-4892-96c3-dc59e4701777",
        "indicator--1fe2f2ae-2266-444f-ae18-aafe3eea6320",
        "indicator--2414dd7e-ff90-4d7c-b699-0f14db5af2b8",
        "indicator--4d89fed2-e906-41d3-8b32-70e111821041",
        "indicator--9f6716ca-f76d-44db-8384-758af0136cfe",
        "indicator--664a5ff8-9965-4056-bc13-2ccbe31e95cb",
        "indicator--1abd1f32-209c-4df4-9cdc-86b8fbe919f1",
        "indicator--15c42677-6dc3-4ef7-ba17-f8cd15f49f62",
        "indicator--7fa03b88-b8ed-49a7-a39c-0dc7ca6d7a4c",
        "indicator--040a475d-ff39-4169-9157-f523a9befc95",
        "indicator--cf4a5ed7-7a52-4528-a0f8-7b22fae21d14",
        "indicator--68e740a0-1da7-4427-8763-0e63efb559bf",
        "indicator--51b20f52-ba8e-4e46-8ed9-a2a1b8ddf0b7",
        "indicator--9c15c10a-072a-409e-b447-d682d44914f3",
        "indicator--7743a080-7b04-404d-9a10-9de7e6882e8d",
        "indicator--6ae49ffa-9a43-4da5-8539-f1ba4c750c43",
        "indicator--657372f6-5702-4f81-800e-2087d2a22193",
        "indicator--5d8f1c97-e416-4f3b-ae50-c54d5ddc4b30",
        "indicator--6ded3c1d-bc1e-462b-ba85-d40d5c834a81",
        "indicator--f1d118b0-4be1-4513-9797-a3fd7d9068c6",
        "indicator--55f16055-26ad-4695-9b0b-6364806e39ff",
        "indicator--d7e321ae-b28d-46ea-bbdd-986ba25c7443",
        "indicator--e8c5e57b-9b69-4b50-be61-ecdf17c45007",
        "indicator--50798fe0-b91b-4b98-8348-3da7f1b20ba8",
        "indicator--f465b2cd-8f22-46f2-869a-ff125a4cc6c8",
        "indicator--e4518aa0-297d-4351-99b7-683bdc41eaa8",
        "indicator--2f4e3e45-3402-4f5e-8673-a0aea6ab1e02",
        "indicator--1ef6d8c0-acb8-4adc-81aa-10cfd0a911d2",
        "indicator--b1766174-900e-4104-be2c-87efcda5a92a",
        "indicator--d5bea103-43e1-4ca1-9579-f3cfbadf8a2e",
        "indicator--65338687-38ed-420c-80b3-6d0f7b395503",
        "indicator--fc81e133-4cf8-4141-a5cb-b5664a15df0b",
        "indicator--14a9a352-c072-4417-b159-259aae678e7f",
        "indicator--2b65943f-8209-4b29-b929-19dc5e350cfa",
        "indicator--9de347db-9131-4d73-b6ea-2a8c762e9254",
        "indicator--ca7abfd4-47fc-4da5-a6b7-78d08f92993f",
        "indicator--10072a9f-055d-4b19-af47-7f68cb51999b",
        "indicator--7730ed9b-60ad-49c5-8759-2f9dd3a75eb0",
        "indicator--ef33c007-4496-4e60-a15c-a0f559fc7902",
        "indicator--1f1481c3-4d92-4dad-b95f-a4071d353bab",
        "indicator--cb805844-03d2-481a-8ffc-7c1e0ba4680e",
        "indicator--31c12e54-bb6b-4a39-b9de-1278a0170dcd",
        "indicator--8dcdf15c-2831-4c0b-b009-318b5b801953",
        "indicator--50b798b1-1619-4cec-a221-a0c70a270814",
        "indicator--c2cba590-054c-42d5-9c7d-cd4ff23f6ca5",
        "indicator--20648bee-b5c1-468d-bb19-eb2684bd7a40",
        "indicator--8c9abac8-12e5-4de0-8cbe-d66291d27e5f",
        "indicator--e9a19e95-ef7b-483a-942b-7b373f9229d2",
        "indicator--1f8723d7-1ab8-4418-8837-5f4c8721ef79",
        "indicator--9f9c0022-fe80-4b6a-9953-db9aea065334",
        "indicator--4e02d4b2-151c-4812-bc82-831d753db06a",
        "indicator--d878fe13-0534-49d1-ae8d-3285343a4941",
        "indicator--fc8ed197-e067-46aa-adda-b56db42b1632",
        "indicator--1fd509e0-23ec-4248-99ce-6563e84a8b7a",
        "indicator--7f353750-b2f4-40a7-b8b2-4aff02883b28",
        "indicator--789b6944-403e-40ee-90b4-e20d83ebbc68",
        "indicator--919496eb-6a93-4e01-803f-f38da11799c3",
        "indicator--9145faaa-b588-4734-bee6-86da73ba520f",
        "indicator--84fd24dc-b323-40ce-8bf7-1ba96e098c36",
        "indicator--708d24ce-b8dd-4dcd-b2ea-4bdb59acc96b",
        "indicator--3b240b01-0b63-4c0a-861b-748ede5cc4f1",
        "indicator--81d5fa00-4f1a-4173-9eee-b9787eef77d2",
        "indicator--1ca63473-bdb6-459b-9cb8-440f8600bfd8",
        "indicator--d5b4fb65-dd79-4fde-98fd-88a465196940",
        "indicator--f24ff9a9-0ccd-4db9-9d31-c7a6ef5827fd",
        "indicator--c78b042d-738b-41eb-a780-8afe423d60b1",
        "indicator--bd96bf7d-f247-426b-b68b-7e89b456ecdb",
        "indicator--24b418fc-ffca-4065-9c5d-0ddf02b232de",
        "indicator--338f6b54-8bde-44c7-b2c5-f64a46af405b",
        "indicator--0d24042a-cea3-4a38-97eb-2d93caeaa27f",
        "indicator--9defc4ad-c2fe-4bf4-9b48-879737233edf",
        "indicator--f557a6e0-b479-457a-915d-d26ce7fe2962",
        "indicator--d12455f3-4034-45a7-8754-218e065bbe12",
        "indicator--234fa1c5-aacc-4bba-90f3-5ba6c38a65d5",
        "indicator--aecf776a-915f-4728-ad57-9ccf8fe75aed",
        "indicator--d53f5542-4d01-47da-a026-982d18147523",
        "indicator--7e9e4bd7-0420-4bda-8f0b-b69032e77a42",
        "indicator--ca78b679-5c85-4d01-bcae-7513e391d83c",
        "indicator--1d5fb196-7f7e-4456-bce6-963147b1bdc9",
        "indicator--0cfaf03a-d2c0-49f7-a3fc-b44bb7cfc777",
        "indicator--27de1863-57d2-4f58-b9a5-d711afe0c9fa",
        "indicator--9acf96dd-3d90-48d0-b026-c847588b669c",
        "indicator--ec58d380-8fce-42dd-b437-92e34ccd1015",
        "indicator--8a4cde1f-c682-45a3-8259-c9d9ed5ca19f",
        "indicator--cb14039e-a6db-4744-a68c-4c03bc9115b2",
        "indicator--c980543b-0440-4acb-9aef-a6769ea70978",
        "indicator--027a9bfc-3c71-4107-afef-97a4630346a8",
        "indicator--80826dae-0e7f-48fc-b69f-47d73ab0c372",
        "indicator--2a4637ee-798a-492d-8169-49e13a908045",
        "indicator--4b559977-fe68-4bbd-9181-f0c09f735b33",
        "indicator--b18579c3-eb08-42db-bae2-55d5bdec871a",
        "indicator--3f9e7203-7bb5-405d-a157-1accee0c1a71",
        "indicator--3c71ee04-7497-47c9-8480-a3e6c59298fe",
        "indicator--35a61dda-6c29-4c85-8651-940f3b6c4fe5",
        "indicator--d80d57ac-f837-4057-a8ab-9223054f3151",
        "indicator--5f32278d-5ca3-428a-a633-00e54b75e96c",
        "indicator--a1aeb8b1-7385-487f-9dc2-cc9b060fead7",
        "indicator--811359b6-ae27-4843-9545-88d9a92dcb29",
        "indicator--6882a353-6d17-452a-a267-a099504be7b6",
        "indicator--06146911-f05a-4a6e-99c3-f1dd98759d0a",
        "indicator--409bcfde-b771-4a2c-abdb-4c37760bd3b3",
        "indicator--babd0fcc-ca83-42ee-b022-0396684e2446",
        "indicator--69e26472-ea4b-4bf6-a6ab-8cf861a441f9",
        "indicator--133bf4d5-b2f5-4f7c-913d-0dd8fcbc918d",
        "indicator--e3634c5a-ee25-41f8-bab5-55e59f27989f",
        "indicator--9f805a9e-dcd3-47be-817a-e1b7b0ed4e15",
        "indicator--7de7bad5-5671-4bed-adf1-b93c724321e3",
        "indicator--1b2c2ce0-bbdb-4ad5-8823-f083e9925940",
        "indicator--620f70f8-bdff-417a-af11-5d32a087d35f",
        "indicator--d76e352b-920d-4811-abf1-9efbc5eb975e",
        "indicator--bda41b22-5f12-4b74-96a7-48e75ececa78",
        "indicator--6423fdcd-4169-4274-a04e-7f9bd57336bb",
        "indicator--ce701a43-0ca5-4853-a639-3d59d98447da",
        "indicator--90b14764-b172-4246-87ab-91c0eeafaaa9",
        "indicator--9fe40dc0-1eef-40ba-b4cf-e7737cadc621",
        "indicator--235e044d-147f-495b-941a-31aaf73bccb0",
        "indicator--4fc32141-e73f-4da9-b45b-ce933709b736",
        "indicator--542c2a9d-1c9e-4e66-8af7-6f0b7727668a",
        "indicator--020acf2f-55a1-41b8-91b0-5790b0ca3be3",
        "indicator--93131b20-04b2-4956-bd1b-b0284c7c43c4",
        "indicator--68ca28e3-7116-4b93-8abc-fac7862823a1",
        "indicator--3ff62667-eecd-48f8-a3e4-7c19bf4f9a1e",
        "indicator--9c8a88d3-9852-4fba-addf-6dbc74d5d858",
        "indicator--3233008b-e615-49f9-a913-a851c8e045d0",
        "indicator--b35f1435-424a-4782-8cca-fe0560996fae",
        "indicator--80418dc3-cc56-4583-a4f8-e401ecaa1a3c",
        "indicator--32ebc25e-b6f8-4e33-acba-df39870d1915",
        "indicator--d98ea06c-8987-4056-a800-e45b0cac448b",
        "indicator--e7a831b3-b849-4ced-b74c-1b74c4f8afec",
        "indicator--4ee30982-c395-4e00-9d67-935680ec95c4",
        "indicator--f121c5c5-0581-4743-a9b7-f3c594aba26e",
        "indicator--44560b76-da8b-426e-850a-a9e34d875f40",
        "indicator--add26371-178d-4f79-9275-617082baaa37",
        "indicator--22843072-f513-4f20-b76e-c1160c4addd4",
        "indicator--028cda3d-e382-406c-b87d-9e8ee0e494a5",
        "indicator--61f35dba-a4e0-4acb-a222-f8cf645a4a36",
        "indicator--197d5400-1d90-435d-b558-a7341c989ea3",
        "indicator--91a0d99d-eab0-4a77-aab4-f9ad96d61fe5",
        "indicator--5b9afecc-705e-4697-ba51-9c1241f49706",
        "indicator--0e6312df-ba5b-4da9-b892-e02aacac50db",
        "indicator--15248f69-5316-4eca-bd01-c1a8cee4c647",
        "indicator--f69af1a4-3a9f-4c7c-b987-cbc4e894f58a",
        "indicator--938da464-7043-4aef-afe9-a87f4b4e4b96",
        "indicator--efe42883-df1b-4430-b480-702b3f7ecdf4",
        "indicator--c12e3b39-def7-44cf-80f9-0e537ed1e403",
        "indicator--2cf60998-c673-4a0f-bbe5-041eb2222718",
        "indicator--1abebedd-e5d6-4400-8304-7ade3b01fd90",
        "indicator--0808f20d-decf-4d6e-a88a-3c8e74fb7a98",
        "indicator--a94b7e1a-f4f6-4deb-a14d-6edd7bac61fa",
        "indicator--12ed9331-2284-43a1-a9ac-c6f3b0a778b7",
        "indicator--fb335778-1449-45d0-a83b-7f2fcdf4b5ba",
        "indicator--c423d8de-a499-45d9-aa1a-4d50d7467839",
        "indicator--60af568f-e51c-4723-b3e2-4cccb5e6c624",
        "indicator--67de1e0d-0f7d-44c8-8363-b83d5a0d3982",
        "indicator--38884418-ad1a-41a1-b2b2-c29d05326311",
        "indicator--537330be-8333-45a2-9ee3-6f93c34a5afd",
        "indicator--90216e02-ed2b-4083-846b-227634b89946",
        "indicator--cc88c00a-3871-42bc-a008-f41ba45a426a",
        "indicator--292f30ea-ad23-4f96-956a-12df7fd61c35",
        "indicator--b505cd99-236d-4773-b1e1-c88d5e79157d",
        "indicator--06090c78-c725-4284-8c5e-3715b28923a7",
        "indicator--82f89771-6bbe-41c9-a89f-46ba0bbbe670",
        "indicator--1a1b9be1-21d8-432e-a45e-3a221787f0d1",
        "indicator--b26d2ed1-3a53-46d1-9c26-77c350d73d84",
        "indicator--61c03249-b01f-4fc0-a8d0-313770b7217c",
        "indicator--2482bdc5-2b45-41e0-b28c-6a27f25620e8",
        "indicator--8a4d0218-6f8b-460b-88bc-3ccd87cf41f2",
        "indicator--95316d0d-067b-4286-a78e-07057c023d2f",
        "indicator--fc0e5ad7-4ad6-465a-8fed-34b88a9e9e55",
        "indicator--97eebd2e-334c-4439-a196-317bb11fa107",
        "indicator--7b8a29ad-a669-4061-ac3d-8c4b822c391a",
        "indicator--a9e51fec-63f9-4c35-92fb-6f07f1f9eb69",
        "indicator--60e7f5b1-0871-4c63-b5a4-2237aa8520b1",
        "indicator--24c4e96e-1d26-47a5-a913-1200f4428772",
        "indicator--ca45eeab-ae3d-4014-b5ff-ce5b2f648771",
        "indicator--69d94431-5f3f-404d-85f7-e57237341adc",
        "indicator--8a5dcec0-75b2-49af-aa41-87139d75a86c",
        "indicator--7bcc0851-7b04-442f-9015-ceca99b8ac3b",
        "indicator--3131330e-470b-4e1a-87c5-9df2d3181696",
        "indicator--f1b199eb-5bb9-45c7-8022-6e25a4ca14ab",
        "indicator--698b5656-c1e3-4ad2-a689-fec8b7ed59fc",
        "indicator--e208436d-90fe-42a6-840c-4103c0cd401b",
        "indicator--f7c17cc7-d8e6-4a3b-832b-4e8e704efd4f",
        "indicator--899516e4-de68-4bed-b408-abc9408e82e3",
        "indicator--6723ed11-9180-4716-a613-336eead2acbc",
        "indicator--647aaeae-feaa-4468-9016-d3d95195c282",
        "indicator--aa477a97-f019-4b55-97bd-f57e6a938336",
        "indicator--9133bb7a-3fdc-4fd0-be55-d5f9ef46471b",
        "indicator--89e15fbb-4907-47a9-84e5-91fbf4ac0a84",
        "indicator--1ead8dc2-35b6-4c15-b81e-c02022aa8eb7",
        "indicator--a84c70d3-d520-4290-848a-ee3e0bb0f8c7",
        "indicator--69c310f0-70b9-4931-92d8-c46f85b57880",
        "indicator--a96f4fe7-c764-4db7-bd8d-21be45422e8a",
        "indicator--fbe0a8ec-7cd3-437a-bcd4-43f9bd23cb78",
        "indicator--fcbf5860-4876-495e-bf94-58cf651636d0",
        "indicator--953dd0b3-7591-4c66-97f5-f50a1f3e9977",
        "indicator--bb3e8f04-79d2-4d5e-bc90-0003228e4830",
        "indicator--fec158a9-3a32-4fbf-aeac-d349b4fbc167",
        "indicator--d26431aa-7942-4135-80fe-521c9a7769e7",
        "indicator--9ea9da1d-955a-43bc-8de3-8a1f7354a0cc",
        "indicator--c5a482ee-82d8-4257-8c8c-9a75a954a774",
        "indicator--c9357cd6-f8f4-424d-89fe-e328a242631b",
        "indicator--70687746-088c-4769-a69b-5d70cb92226c",
        "indicator--00920327-b599-428c-a027-56ed02955d99",
        "indicator--9415805a-39a5-4f74-af67-3ba541d9d758",
        "indicator--216c715d-bf73-49cd-a8c9-c7418dab1593",
        "indicator--9dca88f4-678a-48aa-b6e7-e85b408f419f",
        "indicator--14199dee-946c-4030-96c0-f78a988ea38b",
        "indicator--8e7c50b0-5e74-4ef2-bd9e-ffef4dc44ff2",
        "indicator--2797d98a-c8c9-449a-9f93-822c7b406002",
        "indicator--d5abe141-a922-4b07-85dd-c9402787a147",
        "indicator--496f9dab-99b8-4cf0-9954-0110da278cae",
        "indicator--49d3a5e8-5d71-4152-99af-195526829865",
        "indicator--5decd910-98cc-4509-9d83-1f7c7b4995b9",
        "indicator--27c2eb68-2eea-4d57-b97f-fa2baf3c6404",
        "indicator--6e01f938-674d-492f-a003-e7cf711e087a",
        "indicator--6b8ac1f5-2fe1-429e-be12-a9a14238a5ee",
        "indicator--36b4a786-0d86-44d3-8d5f-a9e1c76e29ac",
        "indicator--5837a1ec-74ea-4036-9f49-4e3ab3cb6258",
        "indicator--ead2ca26-f464-4715-bb97-c33b8c253e64",
        "indicator--9c650e11-dbdb-4f21-97b7-6decae5c48ee",
        "indicator--13f55874-1f67-47f3-873d-aad525efe922",
        "indicator--2941e526-0011-41f3-b365-f5adc6e7d81d",
        "indicator--64366d13-38df-4072-ab23-690b7b3c8b2a",
        "indicator--ae80e489-f635-44f0-a1a9-57f4effd6777",
        "indicator--e8f1921e-a031-4ee9-b96c-01cdf5bfe7b4",
        "indicator--2addf4d7-8a01-4726-a08a-0dba8bb04504",
        "indicator--4473dcbf-3ae1-4ca9-a8a0-85cfe796610b",
        "indicator--a7ab26e1-facd-4b12-9bae-f4c7014b963f",
        "indicator--5e6595e4-7af2-4c2e-a4c4-d0bf4e60a7c4",
        "indicator--cbd93c93-ab83-410e-b2db-c26e3b8f7c6c",
        "indicator--83f93e34-a0ad-42eb-83f1-0bef8e174d83",
        "indicator--40690dcd-a764-4355-a9a2-0ce51c7940f5",
        "indicator--d30ae4df-6cd6-4824-bb18-c5b1c3668f0f",
        "indicator--ce9f38c2-6093-4c57-91c6-4cf6d4b21b67",
        "indicator--66704f55-6eee-494b-91e4-8b2991abcb91",
        "indicator--a5b6cc12-6105-485a-8c9d-5d77ec138527",
        "indicator--e14d725b-9b5b-451d-bb47-045dbaffa4a4",
        "indicator--8378a1c3-ac1e-4332-8a6b-d3609f44404b",
        "indicator--75869bda-636b-4562-9e4d-d73bdf6ef0ab",
        "indicator--d616489e-d714-40ad-a552-abbad76c0a27",
        "indicator--c19d175d-7369-45f3-8415-b0d0d2c7d7bb",
        "indicator--0c058bcf-2bdd-46c0-af40-25a7d3170ae6",
        "indicator--909e3cf7-4c1c-4310-9858-25bd0a824009",
        "indicator--52e059ff-e940-4701-9f3a-854a87ab3744",
        "indicator--07fc2dfd-54af-4058-8420-0758d98dea95",
        "indicator--e51278c9-5d79-4ac7-b676-150521a6e9e8",
        "indicator--4211ca5d-d958-4a7d-966c-f6c098a3de38",
        "indicator--d2d9c6b2-f26d-4430-a232-83fea541a5a5",
        "indicator--6bad3617-a5f1-429e-81b6-eb52d4127f46",
        "indicator--8914d111-4ac1-4d0b-a3c0-d5cc50e84bab",
        "indicator--e6b4e842-9315-4527-b3a3-4259b087ffe8",
        "indicator--ad1a30b7-8ba2-411e-a71e-91fd6d234475",
        "indicator--0cfe1d7c-9f0f-415d-b7f7-bc6b9e68e07d",
        "indicator--be129a9f-4a79-4529-a8e5-197fdd7a0fae",
        "indicator--afeff3b8-d66c-4eb7-b768-d37b3f37a7d9",
        "indicator--88ab386b-319d-4876-a81e-24cf9706edb9",
        "indicator--12002d78-5c2b-4757-9277-cef4b16fdcc5",
        "indicator--a85eabb9-6b4c-4bc5-91bf-9917820a3168",
        "indicator--091e6545-9fac-4d3b-87aa-b3ea491c6e40",
        "indicator--6df6ead4-b827-4ab3-9600-44e22397d5c2",
        "indicator--49b96ed3-e469-4bef-a950-79b5d759b2e7",
        "indicator--104d1423-1731-49f8-aef3-5c6d7aee10e0",
        "indicator--c8501f5b-8c20-484c-bbe3-49b832e958f5",
        "indicator--ec6c87ad-652c-453f-badc-1dcc15e37fab",
        "indicator--e8fb6719-e83c-41f0-a243-47a432d87563",
        "indicator--aaa28a6a-6a41-4109-a43a-f424f9bb275c",
        "indicator--1153bd59-88dc-48e0-94fd-e335e980f445",
        "indicator--1098957f-4bea-430b-b485-0932bb4a3d65",
        "indicator--478dd212-e301-400d-a3f1-759e68c3c8b1",
        "indicator--83f995d5-5f3b-4395-896a-cd9e4b195b23",
        "indicator--6fad9ead-1d6e-4cff-b249-f0f3820a19f2",
        "indicator--960bd210-1721-4d75-a3a4-a919913b8c76",
        "indicator--e45d6dd7-9d72-45b1-87fd-efd1af484eda",
        "indicator--3c0c1c94-8686-40e1-adc0-d4a0c9817fcb",
        "indicator--c251f775-8c84-414e-99bf-f9debd2ce86f",
        "indicator--efa16785-05e8-4162-a92b-9709ebda2e11",
        "indicator--8605893c-e581-4443-8f77-c48f0151cb51",
        "indicator--41f34ec9-6f9e-4b41-a44f-47253b1d5703",
        "indicator--d957bf72-50c3-4ac5-aa6c-939640ca3831",
        "indicator--57bfcdb2-c12b-4591-ae6f-978422d67588",
        "indicator--05077b0f-4178-4db5-88d4-7eba40036c45",
        "indicator--da1e16d8-e380-4875-98fd-450c97e1714a",
        "indicator--b8537f52-1013-4bc6-8ce8-55ad477867d6",
        "indicator--d7a9fa4c-a302-4f1f-94c6-8ccb4d33a6b2",
        "indicator--6a26ad31-e11c-454a-9491-15495ebc8e33",
        "indicator--835ae69f-a3dc-4482-b1fd-b9e2b6f6d4c6",
        "indicator--f619a51d-806a-4632-b1d4-27df374f79e8",
        "indicator--958ea341-65c5-45e2-bbad-fd0bd9f63437",
        "indicator--65af9c6e-415e-43d5-83ed-ee2e8fdbec28",
        "indicator--6dfabf19-0a36-4414-9d65-db148ff5f1a6",
        "indicator--6a8518b0-8f4b-4f47-8395-0c33e93d11b5",
        "indicator--6f464778-0901-40f9-a286-932c92bcfb6f",
        "indicator--d1935455-fa2c-4970-b8c3-5d2ee8df0d8c",
        "indicator--f97341dd-3f47-44ca-9a4b-1c5afa0a08cb",
        "indicator--47aedf4d-2771-4ed4-a843-8b8c0b6e6ad3",
        "indicator--1c916567-7444-4033-a772-a5452e38839d",
        "indicator--6c5dce6c-ed19-48f0-92b3-9a1367d426de",
        "indicator--ecc06b25-b0f8-476c-986c-13a0659b82c5",
        "indicator--a986bbfa-a5d7-4e06-9475-2f1e1542fa88",
        "indicator--9d28ec49-f032-4521-bddf-c4729ccd9ff8",
        "indicator--2478880a-5bdb-4352-8651-37eaf5d84486",
        "indicator--d3c7caaf-535f-4b0f-8c81-540bd13b4a72",
        "indicator--079bade5-4c4e-4828-9157-0d94cd0911c7",
        "indicator--9b2cf059-0985-4656-83f3-bf3de9d8f5d4",
        "indicator--56973978-f5a2-4531-9a65-fcf2a2e4eb9c",
        "indicator--babd6f2f-71c5-48fd-b317-0e144e0e81a1",
        "indicator--d02f7028-e9b4-491d-9aa8-ed2987a326f7",
        "indicator--700c2ab6-e6f1-46aa-9aa6-9cc0f2889487",
        "indicator--1298de79-32e1-4bc1-804f-4d524406a09a",
        "indicator--8a93e230-2a93-49da-84d0-30f26d38856a",
        "indicator--ec6d6654-6b30-486f-8365-6012faf25a68",
        "indicator--85230581-2fa2-4d23-8437-8384bdb7c3a6",
        "indicator--1a39f927-77b7-4b47-8dcd-62ca170bd81e",
        "indicator--fa56facb-af44-4d84-ad06-41407925f623",
        "indicator--e3c548b3-3c84-4660-8d35-efa3c0aa03ad",
        "indicator--2ff0bd76-bdbe-4e9e-97a9-d903a97fe037",
        "indicator--116f95ee-221c-4a0a-9eab-4db3909ff3ba",
        "indicator--cd45bf33-823a-4eaa-b146-685423995ec5",
        "indicator--1c5e352c-49d6-419f-96e0-2f3fc50255bb",
        "indicator--63610861-525e-42b0-95bf-028be96e0363",
        "indicator--16094e33-2657-4334-9039-03ee4f15fabf",
        "indicator--35e6f6f6-ada0-4561-b2c2-ef007e14fbe9",
        "indicator--1bbc7d21-0bc0-49e5-b98e-84527962fc7a",
        "indicator--886ae124-2d36-41a6-88f6-03383b0f42e1",
        "indicator--59f176b7-3775-4083-a141-13559a5c33d1",
        "indicator--b754aaea-04a7-45f5-a807-297127266265",
        "indicator--294bc65d-065d-4ad5-a593-e542c638b4c3",
        "indicator--94596175-4e57-4e86-93bc-deffbc03efa5",
        "indicator--4dbf2de2-9238-45fb-bf44-c5ccea93ead8",
        "indicator--5b3c0f10-7832-449e-8050-c3bee9222203",
        "indicator--b0883da9-23b2-4bde-84c9-ef9a1a4fe331",
        "indicator--fed3a61e-8415-4737-a73c-0d7fd1f0d60b",
        "indicator--a314d22a-45d0-4000-bb5b-595a6c7bcd32",
        "indicator--21b6bf5b-316e-4a38-afb9-109cb173d02a",
        "indicator--5f061e56-ad15-4211-ad69-9faddc28be47",
        "indicator--04874bdc-25d2-4696-abea-1cd3c647c6b2",
        "indicator--6d896050-2f80-42d2-9b83-9c2d45372e65",
        "indicator--59421a91-8aa0-4af6-b807-381e73d9cb3e",
        "indicator--be177006-69db-4087-b4da-17aaa3afd897",
        "indicator--768a84d4-5019-4bc2-aeef-884be38ba87a",
        "indicator--29f955f3-0808-4d87-a080-db0f2f2fc3f7",
        "indicator--67300d93-f65c-4e3e-a4d7-da0f732de70a",
        "indicator--db745662-c3cd-43af-8105-90734aa135c6",
        "indicator--53ffec28-d4e2-49db-817e-af88c4650150",
        "indicator--2a1ced8d-58ee-4b85-9e5a-e45cad2c9cd9",
        "indicator--7b658355-6d92-4ec3-80d5-273f72381969",
        "indicator--1b7264d9-bc20-4d9b-bc52-19cc4b656da4",
        "indicator--46da183e-7c1e-4b9f-a707-e5c165176016",
        "indicator--1f6973f5-1a49-4b02-b913-14611954a4b6",
        "indicator--b939fc4b-e0bd-4e48-96d8-6672675d0608",
        "indicator--6f8644d4-71a0-4f1a-ac6b-9971fe076fd0",
        "indicator--2ddcb891-07cc-4651-8e71-ca64dbe78143",
        "indicator--9808a718-3ab9-4c42-b6b3-aee79e2e0be3",
        "indicator--e7d39e25-f8c3-423c-8b98-09e40647db29",
        "indicator--0577524d-9062-4fbe-82e2-0eb6a97851e7",
        "indicator--ff1a5186-2954-4f0c-a96a-4a5ea7939e70",
        "indicator--2eb7534f-3361-440b-af44-48157a5021db",
        "indicator--7e516953-c8b8-40a7-9479-ed32166b3f5e",
        "indicator--656d2713-5f73-4fbb-ab14-4afce75e01df",
        "indicator--84c5e6b7-f727-45dd-8f2a-3cb0c3a38972",
        "indicator--e49c5a33-8596-4bcd-b9db-d2661a81161d",
        "indicator--d24e4c72-269d-4049-b23c-c2a9d9bb2e80",
        "indicator--88a78e83-8360-4a01-8b45-0936ac36405b",
        "indicator--993282f7-93c5-468d-8af7-cb70c27acf0f",
        "indicator--f29c8ce8-e001-48fa-8e85-8f706e872561",
        "indicator--0afcf427-ba43-4457-8a8c-00d5cf35a78d",
        "indicator--3e449657-f615-4042-b4a2-ce840092a748",
        "indicator--60d15f53-ef39-4bd7-83ed-cff87325b86f",
        "indicator--136e843d-0f4d-4999-b489-a05241d2ae56",
        "indicator--22dc1e87-f999-4699-aff7-b175aa48187d",
        "indicator--ffafaa18-14bd-4c40-a135-08974301211b",
        "indicator--302f20ec-5469-471f-b805-1adb9688edf0",
        "indicator--6e8df8cd-937f-4537-92c7-7d3cb5e4f32c",
        "indicator--28df02d4-73c6-4717-805a-cfb518838ac8",
        "indicator--59829283-0de4-46b4-92d7-f834e531dd06",
        "indicator--5f8de5ac-496e-418f-9e1d-a4fb464d965f",
        "indicator--91a4fca3-234c-4cf3-b41d-8cfce513977a",
        "indicator--901c44f0-81df-4025-aa2a-1ffbef73179b",
        "indicator--bbe4bc95-f3cd-4d5f-a044-da570ed761e0",
        "indicator--d58fe13c-3414-48a0-a008-f0b34a5f256b",
        "indicator--21db0c1d-56f4-4202-83f1-4fc7b7d3c8c2",
        "indicator--64f24033-d704-4c92-88a5-f570752b69ba",
        "indicator--825293ee-d7c6-4367-8633-92dae6f7c75a",
        "indicator--31bf4343-d0da-43fe-8ba2-e482672bea6c",
        "indicator--2888a66c-71e8-49d4-8ad5-dff546010227",
        "indicator--3482b64c-6087-481b-a213-7abd33417a4c",
        "indicator--eac513e9-1ffc-4f8e-8b9e-0bf7b081b02d",
        "indicator--10042647-85ba-481b-8b15-aa26e3a33891",
        "indicator--90663719-1e28-46aa-8e0a-ffc2462ed70f",
        "indicator--fd72bdaa-f2f0-4f78-8981-62762a7eda76",
        "indicator--da587325-269f-4116-8f7b-75281b560267",
        "indicator--050a5304-0715-4091-9e48-b6d2b33abcaf",
        "indicator--34c84b27-94f6-43d5-ac02-8adec35dfc6c",
        "indicator--2db5b13a-d1bc-41a8-a107-600d541a857b",
        "indicator--8945d59e-b1ba-401a-8a46-931b8b44fded",
        "indicator--b3a83eb0-9806-48fe-a105-d3174081ced8",
        "indicator--45e636d5-1e8b-4cf0-acc5-3838a673a261",
        "indicator--dcdb0c5c-585c-4238-8be4-98c79aaea9c5",
        "indicator--1a484150-637b-4687-b838-66c828c6da96",
        "indicator--20a0a4a5-3219-4947-abe4-af9ee7800c8c",
        "indicator--3e77ed7f-1527-40b0-ac92-2a8556e0fa36",
        "indicator--7327ea47-8ed5-4595-ab0a-9bc0bced895a",
        "indicator--ac91d11a-d37d-486d-a05e-8ccc4335b102",
        "indicator--9b06eff6-ea7b-4326-a794-5166287b50cd",
        "indicator--1a13c98f-79dd-4f6e-a388-ab0457add13b",
        "indicator--91826699-cca4-43af-a7e2-7591b55cb5b4",
        "indicator--cfaaa9b2-fa51-4c87-b41f-a2d9cafdd63d",
        "indicator--062d6354-d8ce-4270-af7f-46b24fd38150",
        "indicator--edbb078e-e510-43e0-b466-973aef5d94ca",
        "indicator--c3a3b5d1-cbeb-4c40-9167-ad903338713f",
        "indicator--39bd993b-19f7-4f19-8e47-36e4ea285c42",
        "indicator--eef12f5d-134e-44ff-9ac5-3d192310d033",
        "indicator--9c5f07fa-0d51-46a0-b64c-28c147fcbd0e",
        "indicator--314b6634-462b-42c6-b9f5-2bafb2502125",
        "indicator--8b552010-1b64-44a2-a8b6-61719bab0833",
        "indicator--09a53c20-8cef-4ef7-a2aa-2d8d18ad0268",
        "indicator--8a26bfd0-f704-4ccd-883a-7c71ae84955c",
        "indicator--cc38184a-cf91-4be7-8e06-afcb40f30217",
        "indicator--e7e76dc7-6a70-4441-b5ff-f57aa1249b81",
        "indicator--ca07831a-ebff-4518-acfa-9954d1e10360",
        "indicator--001f3138-e708-4563-a656-1a5867c29331",
        "indicator--8cc6fae6-5ee5-4fbc-b60e-31d0e9a8117d",
        "indicator--c253af42-2a8c-4c63-82d9-827ad3ae67c9",
        "indicator--614e381f-ddae-4fda-a185-74ff1d965e49",
        "indicator--18e54645-e7dd-45f8-866e-eee000be2e63",
        "indicator--7a6535fc-5488-4288-837e-e7d60c64b336",
        "indicator--2a8a7f5d-2de2-4362-b1d0-b05125b65b8c",
        "indicator--9743d745-049c-470b-85e5-1248046b747f",
        "indicator--d095ba62-ac56-476c-8692-62aa57a1fcfd",
        "indicator--c3927bec-00ce-4e53-8bda-87dddf4e75ba",
        "indicator--c12b58a5-0aed-446f-afb1-23d83052da88",
        "indicator--7fe6b9a2-7584-4c82-9f59-7d69aeb9c48d",
        "indicator--49faecb5-9757-44a8-bbd3-dc35283ae1be",
        "indicator--7233510e-7e89-460a-bcc3-529b3d8ebdda",
        "indicator--fe064278-9b7f-455a-a97e-bd72727fae20",
        "indicator--cc628057-cf6c-441d-b184-a05a0e800779",
        "indicator--82959108-44b9-45b9-9aad-cd90118869a8",
        "indicator--5dc0c3d0-e024-4f84-88fe-336b84134203",
        "indicator--30fae17b-96a6-4374-b500-ee31b7c3b45d",
        "indicator--5c260525-1a11-415f-942f-bbb3a0c0dfe7",
        "indicator--56c03186-8669-4d4f-9209-1998613e2a30",
        "indicator--cd61a957-d4b6-42f6-9328-19ade48de934",
        "indicator--7d79fad6-3b04-4afe-a645-744b0e78b15b",
        "indicator--c1c29843-6920-402e-b020-aff80b1cb14b",
        "indicator--f342f73a-f217-4bf0-b841-d69ad407b78b",
        "indicator--5a228d66-cf85-4b33-9cfc-7a29e2fa1c62",
        "indicator--2627b319-1fb3-4d17-bd4f-75a1cf039545",
        "indicator--4b9a0472-38ec-4841-a179-8d945bd29d15",
        "indicator--b5edfc08-124e-47a0-a1ec-6e1e04996d10",
        "indicator--9985b8de-6de1-4a13-8ee0-d6a3dcd22ae5",
        "indicator--80a56669-267b-4ad3-8ac6-af9ae8a094d5",
        "indicator--2b4af062-2e10-4ccb-9883-1ae10c40711e",
        "indicator--bd0fa1ee-1daa-4708-a3eb-857d7f531109",
        "indicator--1564eba5-c075-4f62-b8be-6a6dfcb19f99",
        "indicator--40c22dee-51cf-4a7e-8e1d-8f825758ab1e",
        "indicator--82aae55c-0aa7-4846-b363-0365df29ff35",
        "indicator--06889dc6-e5ff-4bef-ad1a-0cd122891109",
        "indicator--38079a31-1976-41da-8b19-0a85d823b168",
        "indicator--c164523b-aca4-4806-bb93-dc9d70afdcf6",
        "indicator--28cda7ca-78ab-4bc2-9169-99f46ca9b9e5",
        "indicator--0dc5f1c4-6142-402d-93dc-566735765f92",
        "indicator--67098fb7-693b-4bfc-9d45-6b30e2195f56",
        "indicator--575375d3-64d6-42fa-97fe-9c9ca7a7a676",
        "indicator--dfbc03d2-0ef2-46d4-84fe-7842d96dee33",
        "indicator--26e99e55-59bf-44b0-badb-868e3229f37e",
        "indicator--444f4b35-58f2-4418-a8c5-84cf8bf2e643",
        "indicator--6054b759-af00-42d2-9364-3a82217c5566",
        "indicator--ceab398a-6ba1-45f3-a23a-443465481d2c",
        "indicator--00055c8a-af74-4d5b-a002-c32f0b0ecf8c",
        "indicator--af6673f0-d5d7-4d0f-88f8-6fa9ec142802",
        "indicator--2189844c-a6b4-48cd-bddf-d32ae1f43109",
        "indicator--5248052d-fd15-4102-8b4d-80b457a5b775",
        "indicator--adf0351f-16ef-4498-9767-d3ef9200b38b",
        "indicator--4909f12f-6168-47d1-973d-543bc9d0c44e",
        "indicator--3a8ed086-890b-4f89-bee0-9d868ef3ef18",
        "indicator--5477fdbb-b544-47ba-af36-e729518d108e",
        "indicator--2ee1ec7f-3580-49f0-895f-61e941354f57",
        "indicator--e1286b59-967a-42eb-ba70-cd3d5f4071f9",
        "indicator--1bd9894b-1c3d-42a0-8e89-bd27eb40ac15",
        "indicator--26486abc-a58a-4d46-9f1b-b496495b4cd7",
        "indicator--87d65e9c-00e3-4d2a-9dec-c99177323301",
        "indicator--f3218cfc-2deb-4ee2-ad31-1a40f0a43d2f",
        "indicator--01591e47-dc82-43ff-8039-0f009e501545",
        "indicator--dc25e584-31db-476b-95a7-7ec4c1d7a6aa",
        "indicator--bb2027be-1f51-4bcc-9cce-ed2dc0ac6a76",
        "indicator--681afa0e-b154-4d2e-9d19-136dc4c3112c",
        "indicator--6403708d-245f-41eb-b524-67e0e647ee11",
        "indicator--825f334a-48d5-4ce9-9f15-51fbd5e7e321",
        "indicator--31d2f428-012e-412d-bb6d-85d0b2070dd3",
        "indicator--91c03149-35cd-4012-a245-5a489fc6f24b",
        "indicator--8068fd46-03f5-4476-9078-d4da6165f6a0",
        "indicator--a3f6cd8d-1163-4b8e-8c88-1130252612f9",
        "indicator--5596795d-e326-46f5-84d9-af0a85f16a61",
        "indicator--2768cece-d4d5-4256-af66-e2797141e538",
        "indicator--d3f2322c-82dd-481a-aaf2-03838c091a3b",
        "indicator--6365576e-b74a-4332-950c-6d5134884523",
        "indicator--4df41694-8d21-4e0b-ad42-124ad3afbe51",
        "indicator--fc6bfbe9-e1c2-4aaa-8ba3-00dd22745bcc",
        "indicator--012c3028-0659-43aa-95df-d03ed9f82ba5",
        "indicator--76db2443-41d0-4d37-af83-cc04d80bc6e6",
        "indicator--d8056de1-72a6-48d3-8acd-e047a338bd2d",
        "indicator--6691b016-00e6-4fc5-924d-7bc6610d567c",
        "indicator--b9e6416b-7984-4389-baca-d0b564e5bdd5",
        "indicator--917ffdda-f02a-4231-870f-cece02c98050",
        "indicator--742b23aa-808a-46bd-a27a-bc7b94d2330c",
        "indicator--fbafd50f-b559-470f-b00f-079eff6c1f58",
        "indicator--8bbcb272-94f0-46d0-856e-cd160eefcfec",
        "indicator--f9ba9abf-5f2e-4892-a96d-d077d3170e0a",
        "indicator--ca457940-96d9-4361-8019-c61df5d02c25",
        "indicator--11c26fe9-2bbc-426f-bb6f-fa3fd625be9c",
        "indicator--b5f4f172-256d-4190-b9c1-a4f381e4968a",
        "indicator--51096163-93a0-48cc-8584-d8fe82cc9012",
        "indicator--434b4373-35ea-4397-a287-24b08f1fc4df",
        "indicator--bc19a7bc-f122-4472-b77d-a94fe6921f51",
        "indicator--72732dc8-8e47-4212-8ed6-343b22292b43",
        "indicator--3e7f88de-0279-4081-b89f-0c3169e7b59d",
        "indicator--b7f73a82-b59b-47d9-87a0-28f46c100566",
        "indicator--30261058-b764-4ca4-ab4e-09ab76c7ad6b",
        "indicator--ebb08840-c4a7-4d40-91e1-6028b4cd63e6",
        "indicator--5bac5300-4b4b-444d-919b-6d2f7a7e1098",
        "indicator--273962c5-7630-4200-b1fd-80dc0e4ae0e4",
        "indicator--9b51d927-6172-4ad5-9d10-c49db6e3ba09",
        "indicator--19cc3782-2e09-4660-ae62-6f70698b922f",
        "indicator--c28643e9-25aa-4d57-8a52-89ed858c4b87",
        "indicator--237bf5a8-168b-4b3a-8167-7f81f8df985a",
        "indicator--7ffe5435-1bab-447e-af7d-f3c48c3aad8d",
        "indicator--6dc4dbba-c7de-464b-bd75-d49ff1ddf49a",
        "indicator--dc3c5fdd-4aa2-4cd8-878d-7e65a27e9fba",
        "indicator--997b93f7-5849-4098-a5e9-9ec48a0cd275",
        "indicator--4f8f31c8-9482-42d4-94f7-fe90f1663443",
        "indicator--1226c05c-6951-4e6a-b6bd-5faa7367ad2f",
        "indicator--b341ffc7-0a8b-4593-b27b-1bd84ab91ff4",
        "indicator--32556f89-ab08-4873-b2c5-34343392ff61",
        "indicator--50eb9a28-da2d-4551-833b-5acefd10b67f",
        "indicator--8e4740ae-f2e3-43da-91c5-368928b7815f",
        "indicator--35c20e11-587e-446f-9865-6fbaa38945c2",
        "indicator--80be61e7-0e1a-4796-8033-f9baf9f657f4",
        "indicator--17e8bd51-78a3-48b3-a7ba-3b28b1fa2eb2",
        "indicator--6d70fde8-30c2-4803-a5be-516d47f56431",
        "indicator--9bfe0030-5e16-4a31-8887-daf4174d3688",
        "indicator--eeebd287-c2db-45de-808c-0a5e1f49b497",
        "indicator--2d6bc56f-87b9-40aa-8e01-05edb1fd8f14",
        "indicator--df2c0606-7fd6-4524-aeed-11f422dbd858",
        "indicator--a6ea6fbd-6dbb-468f-8006-9ecba45a02ad",
        "indicator--7a115470-acf7-4ac3-845b-b79f20b6bf37",
        "indicator--f8f450be-c194-4f4d-b951-30a7ce2684f7",
        "indicator--7b45c904-6ddc-4ed5-880f-2c2846ce8027",
        "indicator--65ccce02-21f3-4357-b51b-fd5dceb94b14",
        "indicator--ece707e1-df3c-4035-9dad-083951faff33",
        "indicator--6c17f8e9-8811-4c7d-8192-a0e822eb56b9",
        "indicator--c08dcf5b-be0b-4ecb-8381-ac98d0c94775",
        "indicator--1d8cfe3c-f652-4314-a3c4-bbc8d3f74905",
        "indicator--b7d0f0cb-da4d-4717-86a6-4640c6cc1933",
        "indicator--e32a66d7-68f2-4f3d-b09c-f5b70783b912",
        "indicator--68054dae-5c39-4830-a222-6e056599a473",
        "indicator--c679497d-2118-4d39-9194-651c6d31f913",
        "indicator--897a53ee-623b-440f-a46c-23b809ef2120",
        "indicator--da7d4270-4750-4078-b5e2-942f91b78570",
        "indicator--d3398724-c1c8-499a-8ab8-201acea1c93c",
        "indicator--0fc4c120-185b-464e-99c2-eb9e24b7dd09",
        "indicator--97a5c3e6-1327-4973-baf4-34ebd3c39846",
        "indicator--b86c62ab-d569-4d2f-81dd-cb7d9dc63f99",
        "indicator--5c983f85-df06-4a96-8761-4b37cd13e45e",
        "indicator--3f7c466f-d8be-4bf4-a27b-16cd34de821e",
        "indicator--b77c7464-3dce-4136-89f2-b439b5df1737",
        "indicator--8453d62e-c0b9-410d-bdd2-6756e34c7a61",
        "indicator--979fc355-bb49-4d84-83f4-1652bd4a1b89",
        "indicator--e8590e70-5ee4-4f07-ab5c-627cfe8522aa",
        "indicator--dfc04e02-c989-4de8-902b-1060906e7b5b",
        "indicator--daaa072c-2690-4e9f-b8eb-1577adca143a",
        "indicator--6cd6082d-5fbf-4d26-ac19-74ac8808d08f",
        "indicator--04274522-5976-4e2f-b515-50abad22e929",
        "indicator--7f241d26-9aa4-4576-980e-54f358059221",
        "indicator--b42b9c44-5a03-4a72-8dc7-6f982f3ddd66",
        "indicator--2d29480d-9b07-4e86-9681-acd8558b7951",
        "indicator--51cf2278-250f-4219-afee-6e8ffcf38a61",
        "indicator--1544737e-da62-47e2-b136-82f6293c345f",
        "indicator--f82ad02b-c6cd-4fae-ae7c-54074221149b",
        "indicator--8d85856d-0342-4259-bfdc-0cc89a9c93b5",
        "indicator--c4729ba5-2a9e-47e8-b500-5ee4ff1fd350",
        "indicator--0e8d669f-be8a-4524-aa99-03b60d0dbd7b",
        "indicator--2bf2acac-e486-436b-8ae1-86231e2ecc6f",
        "indicator--7e46ee64-7c3c-4de1-8d6b-f9cef346ad8f",
        "indicator--1d7eade6-2d37-4bc7-8aba-9c97617cdc46",
        "indicator--6d04cef0-c055-4eed-ad31-4c6e32258930",
        "indicator--b2f98a28-b56a-4ad9-8f92-5fb4ab968d91",
        "indicator--54fa8aaf-5d6d-42f9-9954-0762d4862ae5",
        "indicator--d2b38f77-975f-477c-8ee2-c6b9e95f9edb",
        "indicator--a3d460ad-b179-403b-96c1-004edf015021",
        "indicator--3681f207-72f7-46a1-917a-d8eaaa5af221",
        "indicator--413706d2-7031-4cba-a1b2-0ffdc9329cca",
        "indicator--ac0e57d6-de9b-4dfc-9a56-cd403111afa8",
        "indicator--74564442-648c-448e-9cb9-4dcad34b44ac",
        "indicator--293f06bd-fbd3-4208-9a48-f1e0849d9fe5",
        "indicator--8415b343-f2ef-4a97-a46e-5ea8db751d4e",
        "indicator--e438ee9b-e6cf-4075-89f9-f19034858dc8",
        "indicator--39ef9c9c-db64-4af1-beba-fa69caabdd47",
        "indicator--cd6790a6-0047-4d6d-96c1-ddba46a55713",
        "indicator--e5df51ab-cfe4-4417-abbc-683ce7316b25",
        "indicator--083ddb13-59d2-4163-9e31-db8f02869a17",
        "indicator--c4143c81-ca52-4a5e-b429-ebc75490dbe6",
        "indicator--c30edf42-d9b2-459e-9ccb-953fc68570a9",
        "indicator--3c80a12e-21c6-498d-8e1a-2e7a55723bb3",
        "indicator--3ae3efeb-3707-45f4-925e-6c7eabbf0fef",
        "indicator--ab67be14-11cf-42c0-877e-4df187a2fb60",
        "indicator--90f9f90e-5233-485f-8fe5-55fe2e9cd5cb",
        "indicator--4e0b8a88-cfab-4f24-bbf5-328842534931",
        "indicator--9acf926e-55e8-4b0d-bff0-f9f2b721f785",
        "indicator--73d58da1-414f-4820-8a92-bd57d3775f9e",
        "indicator--2cc25fc8-1e08-4afe-aae9-afa3a7010ea0",
        "indicator--ccd8ba0b-5e0d-4add-8ad0-48c800a8df55",
        "indicator--c9f27484-8408-4522-adcc-28cb921c6230",
        "indicator--e3fb84f7-a596-4ae6-8da5-fc038eb1b209",
        "indicator--e2ccb2be-4baf-41c7-8e56-9fa77b837f96",
        "indicator--51e9c7db-7b4b-45b0-bb82-6b09c5a8a6d4",
        "indicator--2ffa8a87-ae98-40bc-9db8-0ae66804db01",
        "indicator--b03d72c2-bd0f-4b19-88f4-96243f398778",
        "indicator--70dd3e90-0065-4b98-8390-ac77a4f66630",
        "indicator--41dab730-5461-4efa-b3bd-1de85aa27e66",
        "indicator--a74d0342-24ca-4af1-a5be-637797dd8680",
        "indicator--7344e890-d989-4542-9325-c1ec420ff437",
        "indicator--bf1982a2-68f5-4451-ac53-9b4898247edf",
        "indicator--b058af58-fff6-4740-9949-c0e89663e8dd",
        "indicator--afac38ff-dfa2-4404-adc9-1f9c103b083e",
        "indicator--a62f79a9-cc0c-40a9-a689-cc4920d4ce0f",
        "indicator--ce75ad0f-4c8c-4b8e-a699-5e01d3db25f5",
        "indicator--b4aafb16-ee19-4705-a2d8-7950a59fb992",
        "indicator--8d48bd37-a962-41fd-89d7-5ce020fbb87b",
        "indicator--584cf865-d0e0-4d3c-9329-d0860fbc0f82",
        "indicator--4cd76e63-11d2-4ade-81d3-505763d514cc",
        "indicator--81012e04-51f5-411b-afe9-68b78baf33cb",
        "indicator--3399c6a8-aa02-4dd1-a8ef-0cd04ae0abe7",
        "indicator--c3d9d477-7d44-4e1d-9d88-5bf685a9e2f2",
        "indicator--045d00ae-341a-4c3a-8f58-751692e8cb06",
        "indicator--2f0d5dff-2d01-448b-82ab-967bed2f80cc",
        "indicator--8b39daec-038b-4f24-9a5e-9be3430e2d16",
        "indicator--dfb2ce64-9c9b-48dd-bfe0-987a3444b358",
        "indicator--1be6c704-432d-4006-a0fd-3d67788b011a",
        "indicator--6cb93448-e7fe-4497-90ca-09aaab290332",
        "indicator--92fc8d7b-d14a-4950-86a2-877941aae8c2",
        "indicator--7eac6ad8-a767-461a-821c-0c57dcd36192",
        "indicator--4c5c7fab-5894-4467-9a9f-ad0c3c094e9f",
        "indicator--1d8e2ceb-373c-4501-8ce9-fae781479898",
        "indicator--9964b9db-2aac-4492-ae0a-9113b3f7c74d",
        "indicator--00321099-af7d-4ff5-a15b-1a0208a9d736",
        "indicator--8ad4c4b9-2478-4d98-b3ab-58704b32571e",
        "indicator--e693c94d-193d-4b32-a1dc-d960de8ef719",
        "indicator--9afd1667-4660-496f-82d6-2c332e493908",
        "indicator--abf0b2de-4276-4acb-8fcd-76b0d3db58de",
        "indicator--57cfdee9-ed23-4933-8589-70161550e78e",
        "indicator--95798fc2-a0ee-48cb-afbf-ff7e72ad7985",
        "indicator--6a8dc450-6019-4e05-b228-6adb3a9e0f5e",
        "indicator--a0c88e4d-8fff-4e61-be62-3b19e99d7cf6",
        "indicator--d99e8b08-4851-437d-96c5-d90053ab4ce8",
        "indicator--32c1eed6-1671-418c-afde-ac764fb49c2c",
        "indicator--22b71cea-eab8-4c70-ac77-a0cf9b284a18",
        "indicator--5839c0ce-2f38-4cd2-9db1-1355688503ec",
        "indicator--7cb217a2-6b95-4e16-8d0b-66e6c62a8ad5",
        "indicator--95686819-4241-4c84-8f38-668033fffb8a",
        "indicator--d8823cba-f962-44d8-82f0-163892b8b968",
        "indicator--efd1de54-9887-4663-ac64-0878b0610ecd",
        "indicator--f1309e7f-6588-4510-a436-180f00835cc1",
        "indicator--6966cb33-49cb-49e7-9e05-f22c8a823dea",
        "indicator--aff5d135-8371-4b9d-8ac6-7f1e735e7f49",
        "indicator--5b3a44a7-c8e3-4c06-81f8-eabb75944d8a",
        "indicator--43ae2043-16e7-43ed-8902-7099a9b99f62",
        "indicator--d23e4ee5-a0a1-4201-8e38-4c4aab0d9845",
        "indicator--4e245947-8b52-442e-92b0-fe3a2348e9cd",
        "indicator--f640bf6c-b12c-46bd-a500-4d1cbf62d9b1",
        "indicator--260c2ca0-0dfd-4761-be75-0b305b8c648b",
        "indicator--c2fc0c94-7e3e-4c8a-9ca9-32bd16b790ba",
        "indicator--fe667b37-9c4b-46b7-927b-5f14f1fe2c70",
        "indicator--3335b472-d097-4134-9a1b-5438b7a4582d",
        "indicator--e7e26056-6230-4807-8535-a6b17f64c441",
        "indicator--d02922b4-c21b-4fe7-a5a4-db1e876663fe",
        "indicator--047d1dca-00ac-4558-8fd2-c59b99572926",
        "indicator--8540d6b5-7e6e-4395-b1fc-b4501acb74f6",
        "indicator--2fe8116d-7234-47ec-a46c-34181a91868e",
        "indicator--e6908519-a9c0-475b-aefa-404877867c12",
        "indicator--45bf1fe4-b63f-47fd-aa5b-d07a32f139db",
        "indicator--ddf341ab-b265-4e44-99b3-6d29268fe495",
        "indicator--9c78c980-1711-452b-a613-dd7ca120ab19",
        "indicator--991a62ef-55bf-4669-9c44-1727ce641f1f",
        "indicator--ee7315c9-17cc-46a9-a458-8977b6d332ea",
        "indicator--d5cb314a-cb1f-4c33-ad38-1a3b46348b38",
        "indicator--ebc07da0-73dd-4101-b86c-af43d3e001ed",
        "indicator--3f690731-00d5-4a1e-873a-f854d200c5cb",
        "indicator--09ca6eb0-005b-473d-8e9f-618fd17e4f29",
        "indicator--de60ef2e-d01f-427c-a7b2-69a3f222857f",
        "indicator--9f9c8b0a-0750-471e-aad3-1a5d4a173d2c",
        "indicator--0e099b7f-eb18-41dd-8365-dd040ba06cd6",
        "indicator--9ff86c57-bfc9-4999-a987-16c353255f9f",
        "indicator--9d15ab2d-ce4f-47a4-9ded-0272099da169",
        "indicator--938362a6-7635-433b-a348-eefe0e22b1c0",
        "indicator--ab164e4c-0160-4159-b2c6-eb06fff43ba2",
        "indicator--d728544f-64d8-4216-9b70-8007aa233bc5",
        "indicator--be6d430f-d03e-427e-86f4-e990aeb6c581",
        "indicator--b90f2bbd-b6e6-474a-a4f1-ee11824abfa1",
        "indicator--10aa154c-d001-447c-9ce3-cf02fc2eed6d",
        "indicator--ee864d71-0bba-4ca1-aed6-b2a63ac34527",
        "indicator--77d0cf38-52d3-46a6-bb09-28cc3758c805",
        "indicator--02ca99fc-14ec-464f-af39-73af8ce5d21a",
        "indicator--8931c6f2-1806-4d05-9b20-d8b1c53761a4",
        "indicator--ce0bef0a-b901-48a5-890f-1634a488bb68",
        "indicator--cffde995-8b92-4157-9b1a-653c91f34f4c",
        "indicator--900a1b90-c38f-41b9-bb28-a0eef43e905b",
        "indicator--9f861523-2311-4539-97b1-8ea63f4e4dcb",
        "indicator--f10c4a72-e9aa-47e7-8fad-6c23ac00f5aa",
        "indicator--19de1256-7c4f-4ff3-a87b-a7fe046760b3",
        "indicator--8772296a-bb9d-4053-90c7-94820e749fa5",
        "indicator--0781f449-460a-4815-9243-5f8d6062d7cd",
        "indicator--f16daec4-9c37-419f-91e0-ee859457a993",
        "indicator--17eed3d0-1299-4b62-912d-f0a04d35615d",
        "indicator--c3f2107d-6c00-4839-a748-84b011bcc10a",
        "indicator--7f25bcd5-6895-48f1-8888-a057d450cf3f",
        "indicator--be50ca16-c407-4642-a89f-9128f7ee4be1",
        "indicator--68dd9a4d-702a-46dd-8b78-bf484a3b2d87",
        "indicator--09e88e7a-225a-4b5b-a910-6b8db10c136c",
        "indicator--505dbc16-e405-4c01-a7a4-43616222b880",
        "indicator--cc215133-f976-412d-8b94-caf5d22e63a6",
        "indicator--d78ccf6e-d56c-4e73-a1e9-0a8f482cc231",
        "indicator--4e28faa0-1a15-4581-9371-81fa7cd98d62",
        "indicator--5a6cfc46-8b9e-4246-b2f0-dc9533f938c3",
        "indicator--ef497090-6bf4-483f-af21-49ea590d95e4",
        "indicator--ef1c2276-387b-4269-bed9-0d5a2048fe42",
        "indicator--49b26535-ab32-4abc-85d0-563c7cf1f8e6",
        "indicator--d8148c42-b57e-434b-b432-934e8d080d61",
        "indicator--dcb893e9-a005-4be4-8c11-b3b33465f216",
        "indicator--51c526c7-e939-4db7-945c-130ff98e4cef",
        "indicator--970b84e3-1e23-4b3f-abb8-2c6b143569f9",
        "indicator--880617b1-0922-4fd6-98d8-e1571ed27b05",
        "indicator--63bdce39-6f4e-44ab-9831-330ba6671330",
        "indicator--4f8cdb1a-50a5-458a-9e61-1aead7b28224",
        "indicator--4630284b-c687-4a09-8dad-635f120d308d",
        "indicator--9a4fe4cb-dc1d-41a5-aad2-ddc7623352ce",
        "indicator--7721a90e-065a-4b34-85d0-cfd630140170",
        "indicator--093b86d1-1be0-41eb-880e-498edff5d82b",
        "indicator--57e19779-6cdd-4f5b-b1a9-a2434f37ec0d",
        "indicator--20fc3304-699c-40e8-9daa-817ede97b8c8",
        "indicator--079092c1-6776-44b1-a6c5-5137d9c85279",
        "indicator--0173064e-d581-4d5f-93cc-2fe73f824aed",
        "indicator--5f9774e5-1972-47a8-b8b9-9f605932c2b0",
        "indicator--9999bdb7-dd0c-4413-86b8-57baf41fa1a9",
        "indicator--5221a78d-faca-49f8-889c-84bf32b8eda4",
        "indicator--b6b98985-0ebe-4889-ae2a-2de2f8eb7399",
        "indicator--49707463-a2d9-47a9-9b58-dd881b9a0bd9",
        "indicator--a5ad1035-cfb5-45b2-ba8a-c02c70e75077",
        "indicator--1fa4c9cc-5582-4dc6-867d-6edbd86d893e",
        "indicator--56290187-9991-4118-bf2c-cd42ed92c57c",
        "indicator--0e40264e-a4e2-4e74-8781-902a2ee8f52e",
        "indicator--021602aa-f101-4954-a344-a23a8581d127",
        "indicator--801b6c19-b2d9-4e26-9cf3-0860f67d7a85",
        "indicator--55f88a5a-9a9d-430f-8623-aea528a4dc4b",
        "indicator--99a85658-7a76-4ce2-92f7-b6cc115bcccd",
        "indicator--81fb6f8f-4f92-4eff-b819-a6b6371aaa6b",
        "indicator--4d50633d-3af9-4da7-ae7f-0729b971a27f",
        "indicator--c37df85d-19fb-442a-9b77-c7971cfc4d59",
        "indicator--58787ca8-e734-4bf6-b533-5b2aaa06b62f",
        "indicator--f8296f25-ca91-4003-8ed6-12b3f3b1444b",
        "indicator--5fed55a9-36e0-437c-ad7a-30c1b64460b1",
        "indicator--2cd98388-4daf-4db9-9dc4-2c929dfacdd9",
        "indicator--b27bbbbd-7f54-44d8-98df-d22c84a3c0c3",
        "indicator--d941e9e7-defa-42df-bb22-3a88ca3de12d",
        "indicator--19beff39-c32e-4ecb-86f1-ac51e3772916",
        "indicator--7bfa793b-6552-486d-bbe5-6c7bd57ada29",
        "indicator--ec4191ae-39e9-4d05-90e0-a89045947d0f",
        "indicator--f6a151cd-b000-479d-b7d4-95ad20815b5a",
        "indicator--c2e4cc87-c196-4fe6-883f-663e5a2884f7",
        "indicator--ca1aec5d-e3ee-4b47-89a2-021d35d2e6fa",
        "indicator--7def5365-76ce-42a4-a268-b55c6f461078",
        "indicator--47034d4f-94de-4414-93f7-9f8de54c47f9",
        "indicator--18ba644f-a79f-429d-b9c5-ab4337551421",
        "indicator--c5faa1fb-8e4b-4c64-9180-a4bef32898ef",
        "indicator--745ce08a-7d4b-4836-b5a3-087a5c72ff0d",
        "indicator--969b130d-be16-4291-a5a0-52fbfc4de99d",
        "indicator--49fb972e-6544-401e-a93c-25a61e84bc5a",
        "indicator--deb34e83-2f35-4f0c-95f5-3038614a7812",
        "indicator--62b59177-89cf-4234-9946-e8ee6be5b412",
        "indicator--d9c24e6a-1608-46a6-bdbf-137147ca18c1",
        "indicator--5f4f117d-11cc-4099-a95a-b745f4e6ec24",
        "indicator--d2fa6610-b272-47eb-bf76-5cbade0616d5",
        "indicator--17a7898f-ad6f-4fad-bd0d-86c372e14c5f",
        "indicator--80c311fd-0bf6-4f14-8e46-d83c24c45f72",
        "indicator--1d9296bb-381e-4d4f-956a-058abc514046",
        "indicator--51b1b754-7ccd-4cb2-89b1-a4e3a092d4a7",
        "indicator--8db3e0f2-f368-422c-b058-2bebe26fdad4",
        "indicator--afb221bf-fa2f-485b-9173-cd5e85978e93",
        "indicator--78bec432-1f33-489a-b26f-288526aaf820",
        "indicator--6f63dde9-3661-4773-bac3-d8b3b2a1e107",
        "indicator--098aabd6-b86b-466b-aa7d-0e062b385411",
        "indicator--267bbacd-1def-4b4c-97c3-a5cce3fa4333",
        "indicator--559a61eb-2617-49e9-81ba-d67e373a3e14",
        "indicator--a297ec35-e98f-4b51-9b0d-31adc56e260f",
        "indicator--8ab30d94-cd77-4681-ac9b-96ac57b23a11",
        "indicator--51779d1a-e19f-48d6-909c-0cea81d257f3",
        "indicator--e7f5b852-2707-478d-8ba6-610d3ea6549b",
        "indicator--1ec24313-4a10-4f29-a79f-b8a658c2d5ec",
        "indicator--7a216106-3b1f-4617-ab31-a4d66c4d7f79",
        "indicator--d808930b-94eb-4954-9980-ee919d92ffbb",
        "indicator--cdaf3929-13d7-48bb-b1a6-4d5859a253ab",
        "indicator--fa35c074-c080-43de-8a98-988ab5f7056b",
        "indicator--40c4ade5-82d6-4d5d-a467-4a9b9983200f",
        "indicator--70440523-2104-4f67-8d6b-51e93a8af8d0",
        "indicator--cccbcd53-3e90-41c5-9523-0225d6dfbc3d",
        "indicator--54b61a7a-cadb-4362-adb4-9b6028055a29",
        "indicator--5c3a2e8d-167d-434d-8ee9-da9a61661980",
        "indicator--719a76f2-d512-4bfb-b095-cca9e883e58d",
        "indicator--78903ba4-2744-4c25-96ca-a7596e90db7d",
        "indicator--022dc078-13da-4421-8426-7c3f077a547c",
        "indicator--5136ec5a-c877-474d-a9f8-407f3293080b",
        "indicator--27c079d8-7a2a-4cb4-bba3-d161212e14eb",
        "indicator--d60368d6-43a3-4a8f-9365-3bfd9283e61b",
        "indicator--6e72f6b9-ff8b-440b-89ae-8059b7caf90e",
        "indicator--064f3976-116f-45d8-b6a5-da0916e88a8b",
        "indicator--e6cc0f3e-d5d7-42ca-9056-be8488ae800b",
        "indicator--18e41dc5-c3ba-4d4e-8734-eeabe98087b9",
        "indicator--cda7f70a-ba8e-4a92-8bed-466456505736",
        "indicator--87f963eb-3c34-44d7-90c7-c6fd1733a9f8",
        "indicator--177c49c6-2395-457b-92ec-28be552925fa",
        "indicator--47b28d6a-752e-4312-b54a-249f661e3dd0",
        "indicator--fbf40437-fc36-4023-b823-807f6e3dce7d",
        "indicator--3b9a892f-3739-407b-8912-f0b9aa9508cc",
        "indicator--43deacf6-671e-4ccf-bcdd-8ecdb2d6532b",
        "indicator--19c97261-5a5c-4b55-9e1b-767205a52992",
        "indicator--42f7d581-8370-4469-8fa8-062e88fa9ccc",
        "indicator--a38be5bb-d9aa-4571-a060-cb5940372cc0",
        "indicator--00e1863b-b931-4cec-960f-185add6e072e",
        "indicator--dca69e2c-7925-4678-862e-39d6eac0db0a",
        "indicator--137b29b5-e297-43ce-a988-6dca1b0e2c7d",
        "indicator--8f7f7905-6f08-4a38-be8d-2a7daa703557",
        "indicator--5c230c55-d0ad-4515-8882-9e01aec5f50b",
        "indicator--1b60a3ae-2989-4199-8832-934c0d72a6aa",
        "indicator--60939dbd-d587-4e3d-83ef-b235039c2c90",
        "indicator--24589c4f-2325-40e6-9607-0f5da56ddbc9",
        "indicator--88d26581-9581-4320-85ab-9e83fe15aead",
        "indicator--caf83ef9-9133-4b2e-a0fb-ea8387f35a3c",
        "indicator--67a2adfe-1951-4b4c-b9bb-21da353a9410",
        "indicator--cb52e5ee-fdaa-4785-8ea4-0d0c12cdec07",
        "indicator--8c1d030d-1074-495d-a9ed-e57d52068278",
        "indicator--ed03f624-724d-413d-a0da-46ac085144bb",
        "indicator--bbce3b02-8dc2-4823-9665-05daa7cafbc9",
        "indicator--61b398c8-d3cf-46b9-ac0c-b28d41cce9a6",
        "indicator--bf43d74a-b9e1-4a68-8fcf-177da7fc512a",
        "indicator--c72b69f4-f2cc-4f65-98d2-d25e6b6f2e5f",
        "indicator--f568f17a-25ce-4026-9014-413cbfdc8543",
        "indicator--73949a6b-da68-4860-8253-7230beccc160",
        "indicator--f06f068c-aa66-465c-b1d5-98251e0cc42b",
        "indicator--e282d31c-7472-4d1b-aaae-198add06001d",
        "indicator--cc4da3bb-0da9-4de2-9289-0956044ac707",
        "indicator--9e6c9324-d9e7-4ce3-8aac-74bb2044cdbb",
        "indicator--89241ed8-cccd-4ffb-a808-a25fb7767283",
        "indicator--560064df-2cfb-40e2-8af8-bc86df615393",
        "indicator--aca228a1-280e-489c-be83-0c7c3457b9a9",
        "indicator--758c7b7f-1301-4198-8c52-cd8bbec7ff86",
        "indicator--85d1793a-8ccf-48c5-8fd6-ec87668cb5c6",
        "indicator--861762b0-bfd7-499c-a0fc-f7762621dfc2",
        "indicator--bba057d7-7105-4809-8029-54984297b479",
        "indicator--39e668b8-2270-4b4e-a0b4-726d73ac27e1",
        "indicator--ee69a1de-760c-45f3-bdf2-6b43ffdceb66",
        "indicator--58478b75-3041-488b-b65f-ff53a03f0c1f",
        "indicator--39bb51e8-9c01-49cb-a2bf-52c608a6f5f5",
        "indicator--6c7c2491-c16a-48cd-8a75-bd824cba6a66",
        "indicator--a0620c66-8c63-43d8-bb04-0638c85d7ce6",
        "indicator--29c865ec-dee9-4f50-a77a-efbc247ee7a5",
        "indicator--dbd90453-8c6c-4415-b3b5-ee13e0b71a10",
        "indicator--1e1e3e53-397e-4c3c-b87d-144164390e93",
        "indicator--b899efe0-0ce6-4280-806f-3648cee4ef1a",
        "indicator--84d28b5a-f1f2-4f20-8b9b-ccccbc051048",
        "indicator--c5a6673d-976a-43dc-b00f-597b05c03595",
        "indicator--a80346ea-b033-44c1-bbda-5437f66b04b4",
        "indicator--09ef3c5f-7b47-49eb-b5a2-b6d0dac5c770",
        "indicator--b5a50ab4-3932-425a-a288-e824714b3181",
        "indicator--f90763d5-18d4-417d-8a4a-1325ac9f4d3e",
        "indicator--2d86e662-b5a1-4f46-b618-84545452363b",
        "indicator--f67a6179-f3d8-4e46-a02d-162bf96eafa2",
        "indicator--9a065f90-402c-4832-94e2-9d5cb0a83443",
        "indicator--ea64cae8-cf8c-45bd-b362-b5f093e50d2b",
        "indicator--c6867d9b-c98f-4dac-91ea-dee4f7bac88c",
        "indicator--dc44a5b4-3ddd-4dab-843d-53156284740d",
        "indicator--706406d4-071e-459d-8077-6270482ec655",
        "indicator--76a7e0b9-5311-4405-acac-39f7156f187c",
        "indicator--4bc1b8f5-b298-4f34-8b08-1b055ae2f208",
        "indicator--1ed32274-b27e-4982-81ee-6b29a312c911",
        "indicator--a6f243b8-5fa6-42da-a925-745accf29338",
        "indicator--ecf74664-f835-4b5d-ab9d-2550d6257a2c",
        "indicator--4704acfc-9529-4ec9-b7cd-c5913f2ce3e0",
        "indicator--57c8e6e7-2608-4f96-84a1-33d259cc92fb",
        "indicator--5808f3a6-fa78-4094-9397-5fd999411fe2",
        "indicator--5c5038a1-378c-4c83-888c-1f4bd24da1d7",
        "indicator--f9f90496-ae5b-497c-a1f5-08e7e5be0257",
        "indicator--04cc9364-1f41-4bc6-8b7f-7a91bf87533f",
        "indicator--93ed98b9-912b-4ac0-b080-ef07f582025b",
        "indicator--97c841d5-9a19-424f-926f-7fca01106312",
        "indicator--0de44d56-cb4e-4fc7-9ae2-d1b86354781e",
        "indicator--19b9e8ec-c5fb-4e4e-b414-ec63f6d38dcb",
        "indicator--87975762-9637-44fb-aa5b-58fa31a5c7b3",
        "indicator--9e8ae403-783e-44d9-8c23-9b60e9d51c94",
        "indicator--29a6f0bd-d1c7-4aaf-a79b-4a028dc425e4",
        "indicator--28de8cf3-d7bd-4a42-85c0-9f42f8886811",
        "indicator--a5432210-a65c-4cc6-b92d-72d3701e0361",
        "indicator--a4489480-851c-4fad-9e58-dfc4d751664c",
        "indicator--2f83319e-2ed4-4b8a-9b28-aebcc52b9828",
        "indicator--5d580913-1835-4157-a868-b7f52681d2f1",
        "indicator--46a26322-ea99-43f9-ae21-3cbae08e990a",
        "indicator--051960ba-2a5a-4e84-bafe-9159fdf74e62",
        "indicator--72eae20a-15ed-4e1a-af84-ab9c9738618f",
        "indicator--aa9aa233-a5cd-42ae-90e6-0713e10b3af4",
        "indicator--9580090e-64a0-42ff-9b19-1c32297d796e",
        "indicator--01de726c-b64a-4632-b7b3-58703a149b44",
        "indicator--2f18ea50-f3e9-47c7-a711-9433184860a6",
        "indicator--14426cf0-352a-433e-901e-10fffa9b5d75",
        "indicator--254fe7e9-c89b-40a7-b17f-7b9a3aae3ec8",
        "indicator--64a1d319-e416-46c8-bcaf-b74dd64ab01a",
        "indicator--640c9131-c4f4-4875-9b95-b7187bf80484",
        "indicator--188c8ede-3cc1-4e08-9630-58a56c4b455a",
        "indicator--13ad029e-179b-4150-b1c3-9bdaf844f78d",
        "indicator--d5978b06-5f67-405b-b9df-18d14217ea88",
        "indicator--0ce34643-64aa-4a50-af55-0118fe5a93d6",
        "indicator--eeeabcee-7cb1-4a82-ae17-5566f17fd12c",
        "indicator--48f4b9e7-b3d6-4d12-ab14-0500d663c4d7",
        "indicator--b5e66a96-0398-4705-ae2e-305cb08fd45f",
        "indicator--a1f78c8e-1cd2-4e5e-880a-488a73cf9c8f",
        "indicator--5e552172-1ef7-4a26-bd20-f37cd72931da",
        "indicator--29b3442f-f06a-48d9-9acf-5c1876ccc730",
        "indicator--9c9f44ea-a4f8-4f2f-9918-97a835615f0f",
        "indicator--7d9835c7-ff1e-4a30-b343-24e213c60012",
        "indicator--73891ac7-6e28-4668-aa20-8a630f4b6106",
        "indicator--9cf71a34-9f03-44a7-9927-9c1a819eaa81",
        "indicator--f9748e05-4f3c-41a9-8084-c92a295e7e5a",
        "indicator--8ef60ff9-e7dd-4c95-b57f-11b6ee38a00f",
        "indicator--f7cc5953-92ff-4318-a043-cc0424e31f9f",
        "indicator--88dd206c-0548-43e5-979a-970f730a4c72",
        "indicator--dcaa3ca9-a863-4a57-82fe-5714ace5bb01",
        "indicator--a6f8f241-9619-4314-b2a7-df95f949917d",
        "indicator--96b36f60-555b-4517-bc48-2c6e90716c85",
        "indicator--a23ce0da-2c61-4c9c-89c6-5c8f25c5ae40",
        "indicator--1bab34f9-646c-4fe0-ae7d-9a1afa441596",
        "indicator--70df4b66-e254-4af9-9da3-c1f622b436fb",
        "indicator--79da95ce-962b-4b53-8795-4f054f56f968",
        "indicator--515967bb-88ea-468d-8b42-f535f7ee64fe",
        "indicator--5b866853-118b-493b-b8a2-533eec0e7469",
        "indicator--a215e55f-a08a-4913-a6e5-2ebf5491868c",
        "indicator--592f374f-1482-436f-a172-5fe30c450373",
        "indicator--b7a0160f-e079-4f2d-a6a6-d070da794f58",
        "indicator--3334f9d1-1815-46d3-aacd-555e2084d94d",
        "indicator--649d9faf-b63d-4aea-9b2d-c294f7efd1d5",
        "indicator--e8e6427d-783b-4a0f-8bba-18ac57e2058b",
        "indicator--af1da87b-afd8-42f4-bd69-0cc149920477",
        "indicator--773139ab-95e0-484c-bd65-caaf6e0b014c",
        "indicator--c1ee61ab-158b-4fc0-b5a7-4cac825e903d",
        "indicator--e4862d7a-4014-4487-8d47-1f980007779e",
        "indicator--823ba1de-f7b7-4464-9591-515a1b61f52a",
        "indicator--b933a317-3678-4f88-9822-2bfa70680431",
        "indicator--39e6582b-c0b7-435e-a08c-4e915f78c5b8",
        "indicator--6564e1c8-b2ff-4350-be89-6696eb48eeaf",
        "indicator--508fdc82-bf1c-4a9d-8b9c-b43859e58ea1",
        "indicator--13e2fc93-564e-45db-b325-f524ef0fa609",
        "indicator--6e4e7c74-33dc-4c49-b721-578814cf40e0",
        "indicator--771fe519-8909-42fa-97f6-14db309ac743",
        "indicator--7b5676e1-7578-42d9-9b91-7f3e61df881e",
        "indicator--36d4dea8-20e2-478a-9672-038b3dc53a0e",
        "indicator--f1776c5f-4729-4bf7-a392-acd6bc7b35bf",
        "indicator--90f6fbfa-c48e-45aa-921c-cf416c79c1f8",
        "indicator--d5e0d968-36e3-4253-99d1-3374e5bce0cf",
        "indicator--ebd3a08e-fcd6-4dff-806e-65c237bddeff",
        "indicator--effc7c63-71f1-452f-ac78-23af0cf6311c",
        "indicator--3e37172a-60da-40c2-b202-550b11a640af",
        "indicator--75ed3ee3-577f-4f41-81a0-5e6e97dbf020",
        "indicator--9c73d372-12e7-40a2-8b98-a9f7d0de7c41",
        "indicator--5a34707c-b2ec-481a-8031-5cea648ca9a6",
        "indicator--98dbcd48-ebda-413d-9111-e090935747c3",
        "indicator--55f9828f-d218-47f5-9940-c4012ea21745",
        "indicator--a25859f2-2d9b-43d6-9203-67a5294be3cd",
        "indicator--fc77c6b7-7f87-478c-a46e-bec49fa2765f",
        "indicator--bc5a03dd-88c0-4760-a6ce-70ae31bac1fe",
        "indicator--b1ba231d-a484-4151-b41f-bf8a905f370c",
        "indicator--719367e2-a0e2-44d9-bc36-eaef04be074a",
        "indicator--c2631f01-843c-401a-a981-18dea6d07732",
        "indicator--0c323a3c-4a0d-4bce-bdd7-6d6f285bde72",
        "indicator--47b386e2-1728-46e8-ac5a-da91f82cf2f6",
        "indicator--bff4c7ab-8f61-4122-ae3c-6837dce53e5e",
        "indicator--16e4b43b-2f20-427b-9031-e527409eba19",
        "indicator--d65a4b10-42b6-446b-9662-1d5b6739a080",
        "indicator--b1bcf7dd-fffa-44e0-a35d-554f0995cb58",
        "indicator--7526fd02-88e9-4da2-abd6-d3c17fd013aa",
        "indicator--c13d087f-e9c6-406f-922a-84a656a5c71e",
        "indicator--8fb4a551-36b5-4326-a123-d068af1a6709",
        "indicator--97bd8d98-f92b-4a81-a4d1-85f098e64d6d",
        "indicator--d59abdf2-517b-4b8d-91d9-774cabb1cdae",
        "indicator--28505e21-022e-43f0-8b55-6b886ae2ced0",
        "indicator--7e8b8b81-a909-400c-b831-de30ccddd0cc",
        "indicator--ba27dac5-5c81-4177-a132-ca734d1b777e",
        "indicator--364dc00d-b531-4692-ab69-6e0974d4e3df",
        "indicator--7428ce10-2b70-4545-97eb-841054ac9691",
        "indicator--a2e8bba0-a1b6-49fb-ad98-a58e33e66902",
        "indicator--d3f5a9e8-16e3-403e-b603-bfe707f67634",
        "indicator--cdb71c99-18d0-4322-9fe4-93e103b58fc3",
        "indicator--e482bcba-4809-4b02-97ab-175d683befe1",
        "indicator--08e7fd84-cf8d-4b58-9763-f334dc8f6bf8",
        "indicator--9c885074-4a45-41e9-8caa-7013134d281f",
        "indicator--5960d2b7-90eb-4d41-85d3-957eef073866",
        "indicator--4d06f310-d2f1-4026-874a-73c4a2756221",
        "indicator--9c37c9fe-39ab-4f1a-921f-1b0231d7db5a",
        "indicator--06a631c0-03f0-49fb-a15a-4e109edeac6a",
        "indicator--91ddc244-2fdf-4dc6-af85-b3bdc666d6de",
        "indicator--049bc862-6bee-4733-a28f-60f3d387464e",
        "indicator--12239b67-42e7-4e5c-a10c-3932bf8924a2",
        "indicator--0bfa9d0e-fdad-4447-b64d-4e9722ff4fb9",
        "indicator--81049197-7483-44c3-a579-532fb442824a",
        "indicator--d5d74cf3-cf21-4a66-9dcc-ad509681c23d",
        "indicator--3389ae62-f61a-4a57-b62b-af51bf7199ae",
        "indicator--51133b72-ae9b-49e9-a894-4893e40a069c",
        "indicator--ba71d01a-fa92-4231-9bda-26a27306d625",
        "indicator--4df11e09-bfb6-44c2-8b3b-f5386a4fcac4",
        "indicator--e358ff7b-705c-40fa-b0d4-8f5b6f6a441a",
        "indicator--ca54d6d1-f12f-4cfe-b108-47e3b05837e5",
        "indicator--cbce77d6-051e-412d-adcf-84abacff13e3",
        "indicator--e1c686d6-95dc-43b3-859b-f28e46752c13",
        "indicator--cf93c68a-c298-43bc-bccc-caaf163edabd",
        "indicator--bd579c42-2e22-4d01-9baf-46ff83f8530a",
        "indicator--ffff1aa6-eddb-4d53-a928-418310a17f9b",
        "indicator--f1ce2ece-d59b-4580-8397-0a6483e0aa76",
        "indicator--7c990c32-e7fe-450b-a3cc-60dd31cd8a36",
        "indicator--6641a8b8-aa81-472e-85fd-36d6e7e54c58",
        "indicator--c64800c1-a00e-4db1-9800-dedda747ce0f",
        "indicator--302599db-48da-44cd-b16c-51bda78dae7c",
        "indicator--bea05a90-e534-42c4-b29d-6560ef2b91a8",
        "indicator--cfd2ac42-98e2-4ffd-ad63-47c48fd33713",
        "indicator--f29f3d52-11fc-4e8c-b7df-3d4121e39309",
        "indicator--af73614d-0b53-4726-bc0e-a48da1b6530b",
        "indicator--69639878-2584-4318-87d6-fc1d844f3b3f",
        "indicator--df479334-1b4b-4bbb-be8a-1ede47aba674",
        "indicator--7f1a64dc-32fd-4905-aab8-df4720cd88d9",
        "indicator--cee46674-93de-4e37-a40e-a5f10db70101",
        "indicator--9b50d258-edf8-4ee6-bac0-8d0d895fa033",
        "indicator--17645fd7-d619-46f4-bfe9-bf67c42008df",
        "indicator--cc32bb7f-a02f-47ff-8a99-805e3d657f5d",
        "indicator--1406f9b1-5c62-40f3-997e-a70ca6e808f9",
        "indicator--cbb8d1b4-fc9d-429e-922f-3c7f19009eb9",
        "indicator--40536802-1ce3-45e2-a573-e8c1bff95c44",
        "indicator--46d55dda-6fcd-4e60-a31c-ccf6405fe81f",
        "indicator--6b5c1e40-25d2-459e-ad3d-efdc94a446c8",
        "indicator--96b96327-5f6a-4a0b-80e8-b32bb0877c49",
        "indicator--45611d7d-4cdb-4c7e-b947-f532a81c2b42",
        "indicator--b7ef9779-df35-42b8-8ec2-e72c3179efae",
        "indicator--d05ebab5-9fd2-491d-b5aa-3b9a8b8beb2f",
        "indicator--a0c9ed19-bc7d-4147-b287-4393c36f407f",
        "indicator--b2da9ecc-3857-4596-ab5f-f8d42123f43d",
        "indicator--10dfaa3f-7943-4411-89f0-49f8b1cf56cb",
        "indicator--1608250f-5fa7-4acb-83d0-b57d57461373",
        "indicator--8a0c908f-42ac-4f17-875d-9a4c099080da",
        "indicator--d3dfb7e1-b68a-4436-acb1-36d3b45cf3ed",
        "indicator--f178f635-cf51-4cd8-b374-9d5161b7f754",
        "indicator--8aef4a22-e2cd-4eb0-b872-f2a5d225e700",
        "indicator--3ea12254-4d23-496d-b996-6097a640b186",
        "indicator--f8d2d010-ba73-4707-a688-e7bf54c76223",
        "indicator--b24fcce2-e108-492c-a99a-20f26f21d641",
        "indicator--1861f74f-9487-46e3-b18d-99e2440cb955",
        "indicator--e457c133-d354-4aba-9e29-b408fc6f390b",
        "indicator--9ffab5a6-6bb5-48bb-b714-178752fed525",
        "indicator--a4d039d1-9961-42ef-8f96-21eabec76675",
        "indicator--415b3b91-e2eb-470f-bab4-8e774a43a7ae",
        "indicator--9b526510-6f9d-4768-8dbf-8b21d50c87ce",
        "indicator--8951b63d-09fc-4566-aec1-3e0f85978d4c",
        "indicator--5dbd0747-b985-4dcf-b5f3-62b2e92e2204",
        "indicator--79475ebc-ae55-4861-9935-dcc4c74de0bd",
        "indicator--8ba4c567-527e-44b2-83f7-69293990a5c9",
        "indicator--d0b5fd85-2e89-4ced-bfe6-a9c06d02eaf8",
        "indicator--e43f6578-e8a1-4dfc-8398-06daffa8e90c",
        "indicator--af223f7a-a037-42dc-b363-3507ae375b12",
        "indicator--93db0f3c-3dd2-442f-8df7-c6744dad8585",
        "indicator--ef91f1a8-a2f4-46fa-8b35-2d3e8351de2a",
        "indicator--e7b8bdbf-6a26-407f-9f60-ed2a23dc3e45",
        "indicator--e4dc16c6-be74-4645-9129-c3f9fbf12fa8",
        "indicator--8cba0e21-b833-4b2a-8cc2-6d144652e2a0",
        "indicator--e94809af-6926-49ea-8e07-db5103cf92a2",
        "indicator--0ff33c89-aa73-4e4e-8436-b6e2c8f34c3b",
        "indicator--f5425fa3-d298-4163-b9d7-e5a86f6df653",
        "indicator--257b22d0-dadb-4553-81ea-1fed63bdf5a9",
        "indicator--04468460-2655-4801-8582-1790a6c50f74",
        "indicator--f58304f4-31ae-4285-95ac-fa6b08399cf1",
        "indicator--3e64f2ab-8ef5-4c12-b2da-74bbb04016a1",
        "indicator--02f6bcbf-349f-4417-9f44-555fc7ed6bbd",
        "indicator--9d17a3d4-2de0-4b28-b676-e99cc967e28f",
        "indicator--d132d84e-86ec-43bc-ac1b-c662d76c68fc",
        "indicator--40ecd474-46a4-4cfc-bc44-5e833d9a8923",
        "indicator--ea078ff2-1e92-4046-a8f2-84c7b7a2a552",
        "indicator--cf645e7e-645d-4cbd-bbf5-ff714ced38d2",
        "indicator--f71ad4ff-6896-48dd-ae1d-d663f2d2f853",
        "indicator--220e0a9b-ca89-40f0-bc5f-137c0db39845",
        "indicator--5c21e092-2290-4e94-b4e0-e60478dc792b",
        "indicator--f60c76ad-acb3-48b2-832b-24c06387ebe7",
        "indicator--ba83970a-7adf-44f2-a223-47c06a027fb1",
        "indicator--66d0d8e9-548a-4de8-973e-7c217b885db7",
        "indicator--e27be004-fe95-4284-9a4d-ede51203f981",
        "indicator--42504350-c82c-4644-8974-4b8636df5248",
        "indicator--d93e7555-653f-431d-833e-7c223021417c",
        "indicator--832aa1dc-a33c-460e-846e-e8b1bf22db66",
        "indicator--816150d4-1b3e-4eed-bb66-f366961d86be",
        "indicator--0c5e6938-c67a-40fc-aa90-d3ab05ef345f",
        "indicator--f4870e66-a661-40e6-b706-9ee6eb2d3c0a",
        "indicator--8c2b23c8-104a-4274-a28b-98e23deff66d",
        "indicator--6c0cc3ae-61a2-4332-8ba7-1818ebfd6fdc",
        "indicator--69119d6e-b02d-41db-b31c-3498231dec56",
        "indicator--141db625-9ec8-4801-bf1f-259b67c12fbc",
        "indicator--839c10bb-8d2a-4333-a305-617f0f31a282",
        "indicator--6686bd56-1670-4571-92e4-e82f5bc00731",
        "indicator--819072aa-8eda-4c51-ab66-517e9ae5a2c8",
        "indicator--2246ce10-a794-49af-9127-efe7e8bab7c9",
        "indicator--49a506b1-9b4a-4d3e-bf58-309f7605619d",
        "indicator--ad1af1cd-644a-44c8-a053-e6098af6b5bf",
        "indicator--05865cd5-95ab-4df6-a8c6-5f3a21f23e29",
        "indicator--a80d64a8-7d82-40fc-8594-46ccbc108ba4",
        "indicator--4a27b9d3-12c2-4007-8cae-38dfe7e272cf",
        "indicator--c8a96dd7-8420-499a-b05a-84ee9d180762",
        "indicator--63563ca8-48da-4d26-ac31-42185e8d58bc",
        "indicator--8e50dff4-0c71-4e01-ae12-c865e118aab7",
        "indicator--9fb5967b-ccd8-413e-99b1-9f92e9f33420",
        "indicator--46120c7d-e1aa-4331-a860-c0cce961d2a8",
        "indicator--a8c9321f-7eac-4fb8-9f97-fe3d52d04f6a",
        "indicator--23c92e9a-5653-42c9-894a-7f4c5333374b",
        "indicator--e81148bc-e709-4290-b28c-faf011d829e7",
        "indicator--92e33d3e-1daf-4e56-9621-f4c5c5210d5a",
        "indicator--9908dcdd-2f01-4fd8-8d46-15db03100939",
        "indicator--f88bef9a-32bf-483e-865b-3ab47ac2552e",
        "indicator--6c95278a-9a3a-449e-8b44-dfcbe7d2ece6",
        "indicator--42c4b1e6-fcb0-4fe6-b6ca-129b3c9f0e22",
        "indicator--68c62d3a-5f5f-4480-9258-ee069450fa84",
        "indicator--518f3fd7-511b-436b-abb6-24e4af8bff83",
        "indicator--8c870a1a-2e36-4db8-ab0e-99699a73011f",
        "indicator--a75f4c8f-f4d4-4c31-b5e4-f225ca8dcd0f",
        "indicator--a7e2f7ff-f7e9-4a8c-bc91-83392a40804c",
        "indicator--619cf14a-368c-45fa-9edc-73a49bac7bad",
        "indicator--f2ec1bda-ad99-4911-ab8e-5f7c38216e0b",
        "indicator--1b87f097-e73d-45bc-aadc-7fbf42519d95",
        "indicator--1aa2e89a-033d-4efe-80ce-0bc68f8772f2",
        "indicator--3e4b1674-b8af-4986-84b0-7564b360ece8",
        "indicator--a520ede6-a3bc-447f-9c11-c0eff72cb550",
        "indicator--c3452a33-0631-4db4-8cb8-3cb914e94328",
        "indicator--a985f6ac-1db1-4e64-9bf1-d36caf2943a3",
        "indicator--ac3de06c-8570-4fb4-9db9-5c73ad9816ad",
        "indicator--6c566df7-fb20-45b2-892a-8ed74947cd90",
        "indicator--4eb411dc-e8a0-46e3-9208-27abdc9244ef",
        "indicator--98dabc1c-6e50-44ce-a24e-cd34faa72b48",
        "indicator--20816c33-60be-4710-9d92-2f24f5fcbe0d",
        "indicator--d72775f4-f055-42ea-bacf-885696d18b1c",
        "indicator--ba125fac-97a9-4a45-8d52-79a80e3ddf6b",
        "indicator--6c0b63e6-29b8-488e-8b40-a4178c752998",
        "indicator--538cfc64-b57c-4f84-81fd-345cfec58619",
        "indicator--abffd7d5-e4bb-4d73-a831-486c6d077ad7",
        "indicator--7bea7f73-7a20-4984-a820-3f7377458f38",
        "indicator--2f0c4569-32dd-4e90-b293-4c695f41c38b",
        "indicator--42c2d17c-7ec3-40c4-9e12-3e0ae4444178",
        "indicator--fdbc00f7-7c1b-46ce-bdc0-fc0ec5fcc9ff",
        "indicator--c770c341-09a7-4017-9a9b-9444e40c971d",
        "indicator--37a28b6e-4675-4008-a95c-39466229ac80",
        "indicator--39edf742-b8f4-4c10-b1a2-9bff620d0add",
        "indicator--4418aca1-4209-41f0-9e65-2dd6c4dcc412",
        "indicator--ad66ec34-5c5d-427b-877a-d54f9b1b089d",
        "indicator--1267dd40-365c-4fc6-875b-58b17f06c3ea",
        "indicator--16b480fc-fd45-4c24-90a6-1d5b2bad5514",
        "indicator--d368987a-383b-439e-b617-0f022486106d",
        "indicator--f912e2ca-6a4a-4899-b6e7-515407d3b1e3",
        "indicator--99b68df9-5b59-406a-8c3e-4a59b0f9fe10",
        "indicator--0f940c29-ac98-4de9-b871-ffaab1ab68d4",
        "indicator--afaf64b9-0ad2-4c07-84c6-69064a209001",
        "indicator--ccb67f42-1188-4769-98b0-bb7fc6ec6c33",
        "indicator--a8feb2a3-e797-449b-8002-bf63bd92885f",
        "indicator--60e6dd63-225e-474f-9c8f-d6c574edd192",
        "indicator--a2fb824a-a19b-403b-990c-70dffe6f0675",
        "indicator--74f29da2-b489-41e4-9c4e-4382daa34228",
        "indicator--3501f286-131b-459f-87df-d6e712b432f0",
        "indicator--8ea0bc3a-8c0e-4646-8b25-b4b4a914ee49",
        "indicator--e07b7a2c-9781-4454-ae6b-8d83f41b7efe",
        "indicator--40e40e63-e9d2-4b66-8b55-29e5747a28ef",
        "indicator--e3feaaf8-7ec0-4370-b5d3-4938b6cc6a92",
        "indicator--3a60fc37-b8b1-4de6-a455-5109f3da3ddb",
        "indicator--a0c6efad-00ef-4ff6-8d79-2eee47c562ae",
        "indicator--0fafd49e-2b33-4554-8ae9-37b28f8970ad",
        "indicator--ae58c6ac-9bc4-41a8-958b-735f6396a769",
        "indicator--2801715e-dbc6-4f57-9406-57d57852c281",
        "indicator--973802b5-e3d3-4a00-a780-1df6db3615be",
        "indicator--eeacc2df-9a27-432d-a995-32a09643eede",
        "indicator--23307edc-dcb9-4939-9f8f-9a0bb56fc662",
        "indicator--491ce209-92f4-4ca2-90cc-05e03bfc22c6",
        "indicator--ce2bec05-7ce2-43d9-8e2d-6a20228f8f45",
        "indicator--dc6e5fa9-3c84-4220-bbd9-1bddf376db56",
        "indicator--8aecf30b-ae30-4f4f-a794-edafc9978f8c",
        "indicator--d213b855-f446-437f-bd4c-6c30c755fe89",
        "indicator--a273f10f-9da5-4919-ba54-14ab97ccb19b",
        "indicator--d2eac234-db9f-4cb5-b7c8-76dbfcb4dc9a",
        "indicator--27c7b285-20c4-4738-9b60-6b5c4f638c8d",
        "indicator--c4ffa596-736f-4ab1-ac2e-2a0416435b7a",
        "indicator--bef5e9af-c028-4fed-bb6a-96ae2299a024",
        "indicator--4720a33c-e24a-4c5c-97cf-80e7338b1e6a",
        "indicator--bddd1e2e-89a8-4907-a641-b514b397349e",
        "indicator--23315c1e-866e-43e9-8435-03537ec29e3d",
        "indicator--bb65f8c8-1a51-4983-87a6-4a36b93af718",
        "indicator--1cf54cc1-db9c-47f0-9a37-b1a34ea733ee",
        "indicator--83a100e3-51fc-4063-8d59-bec68aed501d",
        "indicator--610fcd6b-8f1f-4159-ac90-6f21bf25c643",
        "indicator--54d7c922-5a31-4553-b45b-dedd022b2951",
        "indicator--8cfe3528-3015-430d-a20f-bb83b18fad34",
        "indicator--bd8d326f-eb42-4bf7-a560-d27a1e2bdb5d",
        "indicator--66460b15-0c38-4c66-98c6-f2f76febc4e3",
        "indicator--43e9eae1-91c5-40ba-9e54-3a1cf284e899",
        "indicator--65e326a9-c838-44b6-8f36-6a9ae71c97ff",
        "indicator--c0a13a9c-9c77-4123-a691-b0135f173e91",
        "indicator--63afb6e7-302f-4e0c-9319-2785d2a8d1d6",
        "indicator--863b5f89-5e32-49a2-ad38-4b42f11e12e8",
        "indicator--8f32c261-6032-43b6-9348-8d72e27e5394",
        "indicator--acbd417f-72aa-4a2b-9961-2ae8e679f085",
        "indicator--7fc924b2-45b4-46d7-8cc3-694e428077a5",
        "indicator--4ef9d0e0-97bc-4bc4-b38e-c96f0be24d2a",
        "indicator--20d6f92c-81c2-4118-a669-33aefac51ada",
        "indicator--0dddfa4d-022f-45f2-bf5e-756c9e85f790",
        "indicator--a5ae844c-a263-497f-8093-23a5fd977507",
        "indicator--c51a3fea-76f7-49c0-aa3d-1fff794e6077",
        "indicator--6bc20397-1d13-49d5-b90f-3d46b71a103a",
        "indicator--f6ef968a-fc8e-466a-9c50-e10f950f9dd9",
        "indicator--363ba297-fb4f-4285-8253-8cc9c965d2dc",
        "indicator--fb094704-8803-42a5-b2c4-bf47a215063a",
        "indicator--a9b0e37d-1524-4d4d-99b8-310883f2efb2",
        "indicator--dcbef8fd-c501-4465-865f-3c0640147821",
        "indicator--66ce8deb-e862-4af9-b618-f7baeca06ab9",
        "indicator--55170144-605c-4026-8788-3f7f9eb009b2",
        "indicator--166cfa19-dddf-4d0f-8359-44e13645dbb5",
        "indicator--5de86541-830b-4c38-ada5-e2a23d615ea6",
        "indicator--bcc36ac3-4b1b-4c72-88a5-781a0cbb03d9",
        "indicator--9d457c35-1713-4311-8fa1-06867124e036",
        "indicator--dc05f032-5bb6-4afa-9ced-756d2b5103af",
        "indicator--a68c7932-9d32-4040-9b60-76ff45aafc79",
        "indicator--db1e1c62-42f4-43c1-9890-cd8ba89a6f00",
        "indicator--a4c7f291-d3c7-491a-acf6-cbd8b47bdaa9",
        "indicator--4f12b882-2d4d-4921-9657-25fd66bd2594",
        "indicator--d6215b4d-a444-435e-a59d-6ff26b5bb1bd",
        "indicator--1b5b7c3b-d69d-4934-adb0-b456d1a89805",
        "indicator--b237e035-325a-40bd-8c61-8e025be67029",
        "indicator--29620663-efab-4f66-8170-45c6002b21ae",
        "indicator--168cf1eb-f736-4a0e-b1c7-a8650383f172",
        "indicator--2a68f48b-3970-4244-852d-93e0c347f73e",
        "indicator--39a45b45-38c2-4098-9098-ca15ab59db1e",
        "indicator--59bcdde5-88cb-44bd-a377-a39b287de6c0",
        "indicator--0fa8c485-bf96-495a-9953-dbab90baaf31",
        "indicator--fa318bdd-6017-4477-889a-aaaaf0522bb3",
        "indicator--4c41511a-3b22-4e50-a8a6-3944386b89a9",
        "indicator--07b5d167-ea60-4bb9-9a39-a15c3cc27720",
        "indicator--ff939cb4-35ad-4719-833b-ea5a048e24c4",
        "indicator--ebd23530-7d03-45d4-ba62-661d7e32edf6",
        "indicator--07253028-fa65-4337-825e-d0d58b1f5ec5",
        "indicator--17e69e09-2666-4491-99dd-5038e3f1d08b",
        "indicator--5fb0f6db-6680-449b-90bd-8c7b12a53b08",
        "indicator--6d86b696-c9b7-4a66-a49d-8a0b55317e87",
        "indicator--4465b0df-1bbc-48d8-bd86-a2595c4bcb37",
        "indicator--321681fe-e4a3-43a4-bd7c-c5ecbe3bd191",
        "indicator--ddaa05d4-caf0-4860-81cb-03bb393b80b7",
        "indicator--54061f11-a79d-4544-83cd-11e3e7f8fd54",
        "indicator--5abda58d-b8a6-44f1-87c3-480d157957e0",
        "indicator--8b397e9f-aba2-4724-b04c-53e4806012ca"
      ],
      "published": "2026-04-01T00:05:11.533Z",
      "spec_version": "2.1",
      "type": "report"
    },
    {
      "contact_information": "https://otx.alienvault.com/",
      "created": "2026-04-01T00:05:11.533Z",
      "id": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "identity_class": "organization",
      "modified": "2026-04-01T00:05:11.533Z",
      "name": "Open Threat Exchange",
      "spec_version": "2.1",
      "type": "identity"
    },
    {
      "created": "2026-04-01T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia; user(top)=**",
      "id": "indicator--770ad526-8d8b-489e-b2e0-c03617869f9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '110.136.190.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:05:12.000Z",
      "valid_until": "2026-05-03T00:05:09.000Z"
    },
    {
      "created": "2026-04-01T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--5a94ffcd-9dbd-42a2-ab29-dc1c69faf862",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '114.36.147.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:05:12.000Z",
      "valid_until": "2026-05-03T00:05:09.000Z"
    },
    {
      "created": "2026-04-01T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=mssqld; ports=1433; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--0ef48a76-5771-4d83-832a-c3ac9464f84c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '16.58.56.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:05:12.000Z",
      "valid_until": "2026-05-03T00:05:09.000Z",
      "x_nadsec_event_count": 183,
      "x_nadsec_first_seen": "2026-04-01T21:38:40.880Z",
      "x_nadsec_last_seen": "2026-04-30T21:44:46.671Z",
      "x_nadsec_ports": [
        "1433",
        "3306",
        "27017",
        "81",
        "445",
        "1723",
        "21"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mysqld",
        "mongod",
        "httpd",
        "smbd",
        "pptpd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-01T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrord; ports=42; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--1976c0df-3a1b-441d-b9af-96a2b53aa358",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.163.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:05:12.000Z",
      "valid_until": "2026-05-03T00:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-11T20:42:00.147Z",
      "x_nadsec_last_seen": "2026-04-14T13:33:58.089Z",
      "x_nadsec_ports": [
        "1433",
        "42",
        "39491"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-01T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--c9dd80c5-2bd2-4e31-8695-de63a4a30523",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '171.225.209.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:05:12.000Z",
      "valid_until": "2026-05-03T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T00:01:13.708Z",
      "x_nadsec_last_seen": "2026-04-01T00:01:13.708Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-01T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--9483e81b-db6b-4346-b130-62e8d5d256b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:05:12.000Z",
      "valid_until": "2026-05-03T00:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-01T03:32:47.914Z",
      "x_nadsec_last_seen": "2026-04-19T20:33:14.436Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-04-01T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d10bd6cd-7ef3-4a22-915b-e201813d3919",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.118.209.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:05:12.000Z",
      "valid_until": "2026-05-03T00:05:09.000Z"
    },
    {
      "created": "2026-04-01T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PK; asn=135003; asn_org=Multan Cable & Internet Services Pvt Ltd; user(top)=**",
      "id": "indicator--ce9e2d7d-e7f3-4015-8455-95c67f3fb6b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '203.6.209.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:05:12.000Z",
      "valid_until": "2026-05-03T00:05:09.000Z"
    },
    {
      "created": "2026-04-01T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--2801727d-2f71-409d-9646-e608f4d81c16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:05:12.000Z",
      "valid_until": "2026-05-03T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-11T02:44:45.334Z",
      "x_nadsec_last_seen": "2026-04-21T04:11:07.165Z",
      "x_nadsec_ports": [
        "21",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-01T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC; user(top)=a*******s; pass(top)=a********@",
      "id": "indicator--0bc4cec3-6e04-4092-960c-7eec9005cb78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.187.13.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:05:12.000Z",
      "valid_until": "2026-05-03T00:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-05T19:22:54.023Z",
      "x_nadsec_last_seen": "2026-04-23T14:03:04.322Z",
      "x_nadsec_ports": [
        "445",
        "81",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "httpd",
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-01T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=mongod; ports=27017; cc=DE; asn=212512; asn_org=Detai Prosperous Technologies Limited",
      "id": "indicator--0a500bc8-a868-42af-9f7f-f4272fdceaff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:05:12.000Z",
      "valid_until": "2026-05-03T00:05:09.000Z",
      "x_nadsec_event_count": 18,
      "x_nadsec_first_seen": "2026-04-01T06:40:14.646Z",
      "x_nadsec_last_seen": "2026-04-20T22:57:46.938Z",
      "x_nadsec_ports": [
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "212512"
      ],
      "x_nadsec_orgs": [
        "Detai Prosperous Technologies Limited"
      ]
    },
    {
      "created": "2026-04-01T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=GB; asn=20738; asn_org=Heart Internet limited",
      "id": "indicator--31846280-4d44-4538-8436-b8352446afc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.32.228.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:05:12.000Z",
      "valid_until": "2026-05-03T00:05:09.000Z"
    },
    {
      "created": "2026-04-01T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mysqld; ports=3306; cc=BG; asn=213438; asn_org=ColocaTel Inc.; user(top)=r**t",
      "id": "indicator--c6acc65a-c6a1-462f-b5ee-a75af12cc304",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.11.167.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:05:12.000Z",
      "valid_until": "2026-05-03T00:05:09.000Z",
      "x_nadsec_event_count": 1407,
      "x_nadsec_first_seen": "2026-04-01T00:03:41.633Z",
      "x_nadsec_last_seen": "2026-04-23T22:05:03.529Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "213438"
      ],
      "x_nadsec_orgs": [
        "ColocaTel Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-01T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--e652071f-392e-496e-b700-5ac6a63424c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.160.151.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:05:11.000Z",
      "valid_until": "2026-05-03T01:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T00:06:26.582Z",
      "x_nadsec_last_seen": "2026-04-01T00:08:31.369Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-01T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--a0cc86c6-7e3b-4120-9a4b-011155910724",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.176.69.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:05:11.000Z",
      "valid_until": "2026-05-03T01:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-01T00:05:14.968Z",
      "x_nadsec_last_seen": "2026-04-08T08:56:10.011Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-01T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=58461; asn_org=CT-HangZhou-IDC",
      "id": "indicator--7c627d8b-054d-40ae-956c-843a8e92ed5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '115.231.78.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:05:11.000Z",
      "valid_until": "2026-05-03T01:05:10.000Z",
      "x_nadsec_event_count": 24,
      "x_nadsec_first_seen": "2026-04-01T00:26:48.222Z",
      "x_nadsec_last_seen": "2026-04-30T05:30:40.655Z",
      "x_nadsec_ports": [
        "1433",
        "21",
        "3306",
        "81"
      ],
      "x_nadsec_services": [
        "mssqld",
        "ftpd",
        "mysqld",
        "httpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "58461"
      ],
      "x_nadsec_orgs": [
        "CT-HangZhou-IDC"
      ]
    },
    {
      "created": "2026-04-01T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--2b3ef461-a30e-47b8-bb10-f0752e4eac3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '115.74.202.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:05:11.000Z",
      "valid_until": "2026-05-03T01:05:10.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-01T00:07:18.878Z",
      "x_nadsec_last_seen": "2026-04-08T08:56:08.849Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-01T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=11562; asn_org=Net Uno, C.A.",
      "id": "indicator--806d193f-5541-40a2-9e2f-e9858875a1c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '170.245.34.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:05:11.000Z",
      "valid_until": "2026-05-03T01:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T00:48:26.565Z",
      "x_nadsec_last_seen": "2026-04-01T00:50:32.183Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "11562"
      ],
      "x_nadsec_orgs": [
        "Net Uno, C.A."
      ]
    },
    {
      "created": "2026-04-01T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GE; asn=201174; asn_org=Tbilisi City Hall",
      "id": "indicator--4077f294-2b00-432c-9d30-ed0acb56b856",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.83.37.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:05:11.000Z",
      "valid_until": "2026-05-03T01:05:10.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-01T00:30:04.088Z",
      "x_nadsec_last_seen": "2026-04-18T04:57:57.046Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "201174"
      ],
      "x_nadsec_orgs": [
        "Tbilisi City Hall"
      ]
    },
    {
      "created": "2026-04-01T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CO; asn=27837; asn_org=Dialnet de Colombia S.A. E.S.P.; user(top)=**",
      "id": "indicator--3062bce4-4e21-4683-a3a8-62e12c88c89d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.1.167.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:05:11.000Z",
      "valid_until": "2026-05-03T01:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T00:23:30.652Z",
      "x_nadsec_last_seen": "2026-04-01T00:23:30.652Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "27837"
      ],
      "x_nadsec_orgs": [
        "Dialnet de Colombia S.A. E.S.P."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-01T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=10429; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--a49c1388-5d1a-415d-8e19-60f9590f2f18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.200.14.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:05:11.000Z",
      "valid_until": "2026-05-03T01:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T00:48:11.844Z",
      "x_nadsec_last_seen": "2026-04-01T00:50:19.480Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "10429"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-04-01T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--4519b041-a404-4c40-8adc-5fcbc3173540",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '187.191.59.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:05:11.000Z",
      "valid_until": "2026-05-03T01:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T00:28:48.497Z",
      "x_nadsec_last_seen": "2026-04-01T00:30:53.684Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-04-01T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CL; asn=16629; asn_org=CTC. CORP S.A. TELEFONICA EMPRESAS",
      "id": "indicator--5714478e-848d-4f8e-8287-99d6c191391e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.4.195.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:05:11.000Z",
      "valid_until": "2026-05-03T01:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T00:54:15.117Z",
      "x_nadsec_last_seen": "2026-04-01T00:56:22.491Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "16629"
      ],
      "x_nadsec_orgs": [
        "CTC. CORP S.A. TELEFONICA EMPRESAS"
      ]
    },
    {
      "created": "2026-04-01T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=59165; asn_org=Auspice Infratel Pvt. Ltd.",
      "id": "indicator--906eb17e-e7b9-436b-a83c-2097a14aacb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '43.229.225.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:05:11.000Z",
      "valid_until": "2026-05-03T01:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T00:54:04.551Z",
      "x_nadsec_last_seen": "2026-04-01T00:56:10.253Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "59165"
      ],
      "x_nadsec_orgs": [
        "Auspice Infratel Pvt. Ltd."
      ]
    },
    {
      "created": "2026-04-01T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=httpd; ports=81; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--33eeafce-6c1c-49af-966b-38b5fcd5e9cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:05:11.000Z",
      "valid_until": "2026-05-03T01:05:10.000Z",
      "x_nadsec_event_count": 19,
      "x_nadsec_first_seen": "2026-04-01T00:24:26.509Z",
      "x_nadsec_last_seen": "2026-04-23T18:49:05.005Z",
      "x_nadsec_ports": [
        "27017",
        "81"
      ],
      "x_nadsec_services": [
        "mongod",
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-04-01T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=17924; asn_org=SmarTone Mobile Communications Ltd",
      "id": "indicator--f5f22478-a06b-452a-acb5-111a1bc3541d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '49.130.132.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:05:11.000Z",
      "valid_until": "2026-05-03T01:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T00:48:36.936Z",
      "x_nadsec_last_seen": "2026-04-01T00:50:42.111Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "17924"
      ],
      "x_nadsec_orgs": [
        "SmarTone Mobile Communications Ltd"
      ]
    },
    {
      "created": "2026-04-01T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--076015a1-f943-4c82-a106-e4b9a81f0d12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '54.196.240.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:05:11.000Z",
      "valid_until": "2026-05-03T01:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T00:59:04.756Z",
      "x_nadsec_last_seen": "2026-04-01T00:59:04.756Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-01T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=401626; asn_org=Netiface America, Inc.",
      "id": "indicator--f805a635-fb27-4be9-bfee-4ebbbaa82a6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:05:11.000Z",
      "valid_until": "2026-05-03T01:05:10.000Z",
      "x_nadsec_event_count": 18,
      "x_nadsec_first_seen": "2026-04-01T00:48:48.048Z",
      "x_nadsec_last_seen": "2026-04-30T23:11:05.948Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ]
    },
    {
      "created": "2026-04-01T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--ed173082-790f-4776-876e-e3b8d665e121",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:05:11.000Z",
      "valid_until": "2026-05-03T01:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T00:36:15.445Z",
      "x_nadsec_last_seen": "2026-04-01T00:36:15.445Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-01T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--83cf0401-2069-4004-b084-764a3e58a429",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:05:11.000Z",
      "valid_until": "2026-05-03T01:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T00:13:27.305Z",
      "x_nadsec_last_seen": "2026-04-18T05:54:46.885Z",
      "x_nadsec_ports": [
        "81",
        "135",
        "1723"
      ],
      "x_nadsec_services": [
        "httpd",
        "epmapper",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-04-01T02:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--898c8429-b1d2-4f4f-8b68-81995de7f599",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T02:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.144.178.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T02:05:09.000Z",
      "valid_until": "2026-05-03T02:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-01T01:07:12.243Z",
      "x_nadsec_last_seen": "2026-04-01T02:38:22.862Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-04-01T02:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=149662; asn_org=PT Hostnet Data Global",
      "id": "indicator--91ecd978-7d29-4910-90f9-570f0505e26c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T02:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.184.179.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T02:05:09.000Z",
      "valid_until": "2026-05-03T02:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T01:38:32.269Z",
      "x_nadsec_last_seen": "2026-04-01T01:40:43.098Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "149662"
      ],
      "x_nadsec_orgs": [
        "PT Hostnet Data Global"
      ]
    },
    {
      "created": "2026-04-01T02:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=mysqld; ports=3306; cc=CN; asn=136180; asn_org=Beijing Tiantexin Tech. Co., Ltd.",
      "id": "indicator--fb763fbb-1e0a-42d0-9ca7-982cd2e23a6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T02:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.203.57.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T02:05:09.000Z",
      "valid_until": "2026-05-03T02:05:08.000Z",
      "x_nadsec_event_count": 19,
      "x_nadsec_first_seen": "2026-04-01T01:59:13.855Z",
      "x_nadsec_last_seen": "2026-04-22T12:18:42.771Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "136180"
      ],
      "x_nadsec_orgs": [
        "Beijing Tiantexin Tech. Co., Ltd."
      ]
    },
    {
      "created": "2026-04-01T02:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--de9b0b4a-e2da-44a3-913b-5b69584dfe52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T02:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T02:05:09.000Z",
      "valid_until": "2026-05-03T02:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T01:41:39.471Z",
      "x_nadsec_last_seen": "2026-04-01T01:41:39.471Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-01T02:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--32198403-abc6-43ed-8ddd-eb62d9f43890",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T02:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T02:05:09.000Z",
      "valid_until": "2026-05-03T02:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T01:44:42.694Z",
      "x_nadsec_last_seen": "2026-04-01T01:44:42.694Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-01T02:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=GB; asn=212238; asn_org=Datacamp Limited",
      "id": "indicator--9b75d0b9-5229-4200-bd16-0deb2a202316",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T02:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.83.200.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T02:05:09.000Z",
      "valid_until": "2026-05-03T02:05:08.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-04-01T01:06:08.246Z",
      "x_nadsec_last_seen": "2026-04-28T23:18:42.948Z",
      "x_nadsec_ports": [
        "1433",
        "1723"
      ],
      "x_nadsec_services": [
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ]
    },
    {
      "created": "2026-04-01T02:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=22085; asn_org=Claro SA",
      "id": "indicator--8d137a75-d47b-4a07-ba20-98255e7a884f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T02:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '187.25.233.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T02:05:09.000Z",
      "valid_until": "2026-05-03T02:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-01T01:17:37.132Z",
      "x_nadsec_last_seen": "2026-04-01T01:25:08.981Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "22085"
      ],
      "x_nadsec_orgs": [
        "Claro SA"
      ]
    },
    {
      "created": "2026-04-01T02:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--d34393b0-351a-4138-938a-b6de0924d055",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T02:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '222.252.30.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T02:05:09.000Z",
      "valid_until": "2026-05-03T02:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-01T01:59:25.410Z",
      "x_nadsec_last_seen": "2026-04-01T01:59:26.782Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-01T02:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=SN; asn=37196; asn_org=SUDATEL-SENEGAL",
      "id": "indicator--f4b9d443-8238-4f8a-bb24-9bdd9cd08188",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T02:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.219.61.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T02:05:09.000Z",
      "valid_until": "2026-05-03T02:05:08.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-04-01T01:22:00.579Z",
      "x_nadsec_last_seen": "2026-04-25T11:43:28.431Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SN"
      ],
      "x_nadsec_asns": [
        "37196"
      ],
      "x_nadsec_orgs": [
        "SUDATEL-SENEGAL"
      ]
    },
    {
      "created": "2026-04-01T02:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--47d63bdf-7d31-4836-bdcc-6edc7f9507be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T02:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '59.126.165.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T02:05:09.000Z",
      "valid_until": "2026-05-03T02:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T01:40:19.461Z",
      "x_nadsec_last_seen": "2026-04-01T01:42:24.128Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-01T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=135247; asn_org=K Net Solutions Pvt Ltd",
      "id": "indicator--6581586d-68fb-44ae-bde8-3dad6cbad269",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.219.207.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T03:05:02.000Z",
      "valid_until": "2026-05-03T03:05:00.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-01T02:14:34.492Z",
      "x_nadsec_last_seen": "2026-04-03T08:23:44.825Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135247"
      ],
      "x_nadsec_orgs": [
        "K Net Solutions Pvt Ltd"
      ]
    },
    {
      "created": "2026-04-01T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--d3c0c2e0-3cf1-47a9-84fd-c2bb33c3eb4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '122.2.23.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T03:05:02.000Z",
      "valid_until": "2026-05-03T03:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T02:19:48.017Z",
      "x_nadsec_last_seen": "2026-04-01T02:19:52.962Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-04-01T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--38453f77-9097-4aad-a13f-77a21c90d2ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T03:05:02.000Z",
      "valid_until": "2026-05-03T03:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T03:02:07.129Z",
      "x_nadsec_last_seen": "2026-04-01T03:04:14.492Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-04-01T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--2a7c4707-a0ef-454f-ba7e-3bc9e7cec03e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.116.101.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T03:05:02.000Z",
      "valid_until": "2026-05-03T03:05:00.000Z",
      "x_nadsec_event_count": 171,
      "x_nadsec_first_seen": "2026-04-01T02:42:45.542Z",
      "x_nadsec_last_seen": "2026-04-30T17:33:21.258Z",
      "x_nadsec_ports": [
        "445",
        "1723",
        "27017",
        "81",
        "1433",
        "3306",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "pptpd",
        "mongod",
        "httpd",
        "mssqld",
        "mysqld",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-01T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EC; asn=28006; asn_org=CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP",
      "id": "indicator--c7023b20-3091-499e-9e27-ca25191d2885",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '181.113.59.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T03:05:02.000Z",
      "valid_until": "2026-05-03T03:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-01T03:01:02.594Z",
      "x_nadsec_last_seen": "2026-04-01T03:01:07.384Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "28006"
      ],
      "x_nadsec_orgs": [
        "CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP"
      ]
    },
    {
      "created": "2026-04-01T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=401626; asn_org=Netiface America, Inc.",
      "id": "indicator--6db49d8c-94b7-4925-96ff-116599121978",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T03:05:02.000Z",
      "valid_until": "2026-05-03T03:05:00.000Z",
      "x_nadsec_event_count": 16,
      "x_nadsec_first_seen": "2026-04-01T02:13:38.584Z",
      "x_nadsec_last_seen": "2026-04-30T03:26:56.371Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ]
    },
    {
      "created": "2026-04-01T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=23; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--54831fef-7445-487d-bdd7-fb58e256e251",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '78.160.114.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T03:05:02.000Z",
      "valid_until": "2026-05-03T03:05:00.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-04-01T03:02:15.887Z",
      "x_nadsec_last_seen": "2026-04-01T03:05:13.199Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-01T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--e5adfc59-2989-4ab3-a0fa-67853a81f457",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '82.200.135.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T03:05:02.000Z",
      "valid_until": "2026-05-03T03:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T02:23:55.188Z",
      "x_nadsec_last_seen": "2026-04-18T06:59:34.146Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-04-01T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133275; asn_org=Gigantic Infotel Pvt Ltd",
      "id": "indicator--4bb6e567-2ce4-4570-8f68-b742566ca73e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.208.200.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:05:10.000Z",
      "valid_until": "2026-05-03T04:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T03:41:28.072Z",
      "x_nadsec_last_seen": "2026-04-01T03:43:33.550Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133275"
      ],
      "x_nadsec_orgs": [
        "Gigantic Infotel Pvt Ltd"
      ]
    },
    {
      "created": "2026-04-01T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--2813da68-b372-4b78-a294-fc38c697b44d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.162.147.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:05:10.000Z",
      "valid_until": "2026-05-03T04:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T03:34:36.129Z",
      "x_nadsec_last_seen": "2026-04-01T03:36:40.856Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-01T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--58fcc6db-3cd8-4803-a597-453f4bac2d67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '119.42.86.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:05:10.000Z",
      "valid_until": "2026-05-03T04:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T03:55:13.505Z",
      "x_nadsec_last_seen": "2026-04-01T03:57:18.522Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-04-01T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--046fbdea-8ca3-415f-b934-9635102da0ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '120.193.188.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:05:10.000Z",
      "valid_until": "2026-05-03T04:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T03:53:56.231Z",
      "x_nadsec_last_seen": "2026-04-01T03:56:01.552Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-04-01T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--90670556-e247-4b70-bc5d-7d18025d5446",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:05:10.000Z",
      "valid_until": "2026-05-03T04:05:08.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-04-01T03:11:54.324Z",
      "x_nadsec_last_seen": "2026-04-05T16:53:42.423Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-04-01T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--04c6c9e2-24fe-4a54-8f61-afcccdd349d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.210.123.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:05:10.000Z",
      "valid_until": "2026-05-03T04:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T03:59:21.282Z",
      "x_nadsec_last_seen": "2026-04-01T04:01:28.441Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-01T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--5e57edb7-aecb-4995-a880-bd29c8ed0947",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.211.16.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:05:10.000Z",
      "valid_until": "2026-05-03T04:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-01T03:48:43.733Z",
      "x_nadsec_last_seen": "2026-04-01T03:49:10.138Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-01T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d72e1939-6fc0-4c3a-abce-dfa241e40175",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.80.88.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:05:10.000Z",
      "valid_until": "2026-05-03T04:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-01T03:39:38.527Z",
      "x_nadsec_last_seen": "2026-04-23T22:28:50.534Z",
      "x_nadsec_ports": [
        "445",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-01T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--f2c50152-7d4e-4ed5-97c6-7468f28168ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '222.252.15.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:05:10.000Z",
      "valid_until": "2026-05-03T04:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-01T03:34:42.751Z",
      "x_nadsec_last_seen": "2026-04-01T03:41:13.826Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-01T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--c2760d42-3810-4bdd-b5b6-dbbe8697c7dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.193.119.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:05:10.000Z",
      "valid_until": "2026-05-03T04:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-01T03:18:48.211Z",
      "x_nadsec_last_seen": "2026-04-22T07:21:49.022Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-01T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=mongod; ports=27017; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--3231a295-d22d-4121-a1c3-c5f1a813a440",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:05:10.000Z",
      "valid_until": "2026-05-03T04:05:08.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-04-01T03:54:55.376Z",
      "x_nadsec_last_seen": "2026-04-01T03:55:15.262Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-04-01T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--77c54970-e76f-47a5-b5ba-a5af6762e3ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '49.48.61.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:05:10.000Z",
      "valid_until": "2026-05-03T04:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T03:30:47.300Z",
      "x_nadsec_last_seen": "2026-04-01T03:32:51.712Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-04-01T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--1cb0502a-5d41-40b8-8efe-6ad811e17e6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '58.69.78.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:05:10.000Z",
      "valid_until": "2026-05-03T04:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-01T03:25:22.192Z",
      "x_nadsec_last_seen": "2026-04-01T03:32:01.190Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-04-01T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--d1de4275-fa25-4bff-a718-97502f11a16d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:05:10.000Z",
      "valid_until": "2026-05-03T04:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-01T03:33:12.128Z",
      "x_nadsec_last_seen": "2026-04-30T02:15:21.832Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-01T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--9525cd3f-a376-4380-988d-afaf37bfeceb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:05:10.000Z",
      "valid_until": "2026-05-03T04:05:08.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-01T03:42:53.692Z",
      "x_nadsec_last_seen": "2026-04-18T05:50:28.194Z",
      "x_nadsec_ports": [
        "445",
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-01T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--68efc5bd-3f31-4552-bc5e-ef33af2d0417",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.0.231.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T05:05:11.000Z",
      "valid_until": "2026-05-03T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T05:01:13.596Z",
      "x_nadsec_last_seen": "2026-04-01T05:03:18.354Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-04-01T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--9308a7ca-38fd-46af-8109-827c15d8287a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '159.89.28.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T05:05:11.000Z",
      "valid_until": "2026-05-03T05:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-04-01T04:41:46.086Z",
      "x_nadsec_last_seen": "2026-04-01T04:42:48.689Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-01T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--fcc72189-776b-4849-a504-45a3bb0c5b58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.10.129.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T05:05:11.000Z",
      "valid_until": "2026-05-03T05:05:09.000Z",
      "x_nadsec_event_count": 45,
      "x_nadsec_first_seen": "2026-04-01T04:44:16.441Z",
      "x_nadsec_last_seen": "2026-04-01T04:46:28.531Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-04-01T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--193a4207-5cae-41db-ade6-4601ce88dea4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.253.21.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T05:05:11.000Z",
      "valid_until": "2026-05-03T05:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-01T04:31:29.941Z",
      "x_nadsec_last_seen": "2026-04-01T04:36:42.737Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-04-01T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--a49cfce2-4b94-4fb0-a8b3-1011a4fa8700",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.175.89.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T05:05:11.000Z",
      "valid_until": "2026-05-03T05:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-01T05:02:01.687Z",
      "x_nadsec_last_seen": "2026-04-01T05:02:06.328Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-01T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--1a1cfd73-4b48-4d24-b44e-3e28b735b7a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '209.38.193.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T05:05:11.000Z",
      "valid_until": "2026-05-03T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-01T04:42:56.526Z",
      "x_nadsec_last_seen": "2026-04-01T04:42:57.115Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-01T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--02669d59-13b5-4a3c-b56f-216c46071f89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '223.233.72.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T05:05:11.000Z",
      "valid_until": "2026-05-03T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T05:04:07.751Z",
      "x_nadsec_last_seen": "2026-04-01T05:06:12.681Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-04-01T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--be4f1d22-4742-4b33-a1b1-be71cac258e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.52.173.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T05:05:11.000Z",
      "valid_until": "2026-05-03T05:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-01T04:35:30.034Z",
      "x_nadsec_last_seen": "2026-04-11T09:28:02.849Z",
      "x_nadsec_ports": [
        "27017",
        "81"
      ],
      "x_nadsec_services": [
        "mongod",
        "httpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-01T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IQ; asn=206206; asn_org=Kurdistan Net Company for Computer and Internet Ltd.",
      "id": "indicator--42bfca8d-7dcc-43ee-a715-e7da09df5c53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.156.104.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T05:05:11.000Z",
      "valid_until": "2026-05-03T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T04:22:08.060Z",
      "x_nadsec_last_seen": "2026-04-01T04:24:14.885Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IQ"
      ],
      "x_nadsec_asns": [
        "206206"
      ],
      "x_nadsec_orgs": [
        "Kurdistan Net Company for Computer and Internet Ltd."
      ]
    },
    {
      "created": "2026-04-01T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PK; asn=141031; asn_org=Connect Communication",
      "id": "indicator--b2c58437-d29c-419d-b0da-e30cebdc9875",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '39.34.173.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T05:05:11.000Z",
      "valid_until": "2026-05-03T05:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-01T04:34:47.273Z",
      "x_nadsec_last_seen": "2026-04-01T04:39:03.916Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "141031"
      ],
      "x_nadsec_orgs": [
        "Connect Communication"
      ]
    },
    {
      "created": "2026-04-01T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--835d8321-4a92-4944-a74b-7ec349bf418b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T05:05:11.000Z",
      "valid_until": "2026-05-03T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T04:50:30.024Z",
      "x_nadsec_last_seen": "2026-04-01T04:50:30.024Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-01T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--8d974e63-f1fe-4fd5-b3fa-7eaaea32ff0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T05:05:11.000Z",
      "valid_until": "2026-05-03T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T04:50:30.265Z",
      "x_nadsec_last_seen": "2026-04-01T04:50:30.265Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-01T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--abc8b59b-0eec-4ccf-b636-e91ba591ecb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T05:05:11.000Z",
      "valid_until": "2026-05-03T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T04:42:58.224Z",
      "x_nadsec_last_seen": "2026-04-01T04:42:58.224Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-01T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--5a108da8-e64b-4123-bf7f-7acb61c24295",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T05:05:11.000Z",
      "valid_until": "2026-05-03T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-01T04:42:58.706Z",
      "x_nadsec_last_seen": "2026-04-07T13:55:23.119Z",
      "x_nadsec_ports": [
        "135",
        "1723"
      ],
      "x_nadsec_services": [
        "epmapper",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-01T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17625; asn_org=BlazeNets Network",
      "id": "indicator--7e5cfe02-7130-4ed0-b6ed-4074012e4467",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.19.134.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:05:05.000Z",
      "valid_until": "2026-05-03T06:05:03.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-04-01T05:59:04.013Z",
      "x_nadsec_last_seen": "2026-04-28T03:28:08.680Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17625"
      ],
      "x_nadsec_orgs": [
        "BlazeNets Network"
      ]
    },
    {
      "created": "2026-04-01T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=136180; asn_org=Beijing Tiantexin Tech. Co., Ltd.",
      "id": "indicator--644f511c-ad18-41de-a645-5310b8d3d4b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.203.57.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:05:05.000Z",
      "valid_until": "2026-05-03T06:05:03.000Z",
      "x_nadsec_event_count": 18,
      "x_nadsec_first_seen": "2026-04-01T05:35:31.215Z",
      "x_nadsec_last_seen": "2026-04-29T06:39:35.409Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "136180"
      ],
      "x_nadsec_orgs": [
        "Beijing Tiantexin Tech. Co., Ltd."
      ]
    },
    {
      "created": "2026-04-01T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=377; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--280aa227-5550-4784-b502-5a5ffe002bab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '122.176.149.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:05:05.000Z",
      "valid_until": "2026-05-03T06:05:03.000Z",
      "x_nadsec_event_count": 3165,
      "x_nadsec_first_seen": "2026-04-01T05:56:18.975Z",
      "x_nadsec_last_seen": "2026-04-01T06:30:52.876Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-04-01T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--5be0178f-31c3-40f2-b4c5-9f9c66caf2bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:05:05.000Z",
      "valid_until": "2026-05-03T06:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T05:46:56.705Z",
      "x_nadsec_last_seen": "2026-04-01T05:46:56.705Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-01T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--992badb4-63b6-4474-a7ee-fac95ca5f33d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:05:05.000Z",
      "valid_until": "2026-05-03T06:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T05:41:59.680Z",
      "x_nadsec_last_seen": "2026-04-01T05:41:59.680Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-01T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--9c46a9c6-8bf3-4fc9-bb31-297777e05f8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:05:05.000Z",
      "valid_until": "2026-05-03T06:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T05:29:28.987Z",
      "x_nadsec_last_seen": "2026-04-01T05:29:28.987Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-01T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=25159; asn_org=PJSC MegaFon",
      "id": "indicator--b18fd9d3-9ee9-43b6-a0b2-e60ffe01cae7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '31.173.31.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:05:05.000Z",
      "valid_until": "2026-05-03T06:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-01T05:56:34.337Z",
      "x_nadsec_last_seen": "2026-04-01T06:03:02.944Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25159"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-04-01T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--1d452aa8-63c0-4432-b35c-5be7d418c6a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:05:05.000Z",
      "valid_until": "2026-05-03T06:05:03.000Z",
      "x_nadsec_event_count": 16,
      "x_nadsec_first_seen": "2026-04-01T05:51:29.152Z",
      "x_nadsec_last_seen": "2026-04-26T22:40:19.489Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-04-01T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--60d38d3e-c1c0-4e1e-abfd-e9417c598517",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '48.214.144.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:05:05.000Z",
      "valid_until": "2026-05-03T06:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T05:33:16.792Z",
      "x_nadsec_last_seen": "2026-04-01T05:33:16.792Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-01T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--e041add6-6fd9-4774-9271-cb0ae0289961",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '59.173.109.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:05:05.000Z",
      "valid_until": "2026-05-03T06:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T05:53:51.903Z",
      "x_nadsec_last_seen": "2026-04-01T05:53:51.903Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-01T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=401626; asn_org=Netiface America, Inc.",
      "id": "indicator--d11578f8-dc37-4e7c-bf13-41662a7c2447",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:05:05.000Z",
      "valid_until": "2026-05-03T06:05:03.000Z",
      "x_nadsec_event_count": 38,
      "x_nadsec_first_seen": "2026-04-01T06:03:18.429Z",
      "x_nadsec_last_seen": "2026-04-30T08:03:34.049Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ]
    },
    {
      "created": "2026-04-01T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--b9a42f13-b49e-4114-bcaa-1995427929a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:05:05.000Z",
      "valid_until": "2026-05-03T06:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-01T05:27:25.328Z",
      "x_nadsec_last_seen": "2026-04-15T14:16:08.833Z",
      "x_nadsec_ports": [
        "81",
        "1723"
      ],
      "x_nadsec_services": [
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-01T08:06:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=45588; asn_org=Bangladesh Telecommunications Company Limited BTCL, Nationwide PSTN Operator and Data and In",
      "id": "indicator--5b7e4a03-c667-40ae-b450-b97fa548ebf6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T08:06:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '114.130.181.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T08:06:29.000Z",
      "valid_until": "2026-05-03T08:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-01T07:46:30.740Z",
      "x_nadsec_last_seen": "2026-04-01T08:39:00.260Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "45588"
      ],
      "x_nadsec_orgs": [
        "Bangladesh Telecommunications Company Limited BTCL, Nationwide PSTN Operator and Data and In"
      ]
    },
    {
      "created": "2026-04-01T08:06:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--0b67a56f-0a5c-4c67-9d4f-7a22de8ad548",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T08:06:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '2.63.139.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T08:06:29.000Z",
      "valid_until": "2026-05-03T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-01T07:53:37.460Z",
      "x_nadsec_last_seen": "2026-04-01T07:53:37.851Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-01T08:06:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a0257466-f8b6-4831-9431-49dd88f8baea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T08:06:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.55.36.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T08:06:29.000Z",
      "valid_until": "2026-05-03T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T07:12:56.925Z",
      "x_nadsec_last_seen": "2026-04-01T07:12:56.925Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-01T08:06:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--85fb7877-c1e8-4a65-9999-70a71b658435",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T08:06:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T08:06:29.000Z",
      "valid_until": "2026-05-03T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-01T07:37:16.502Z",
      "x_nadsec_last_seen": "2026-04-01T07:37:16.855Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-01T08:06:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--d6d09943-961e-4c6a-86d6-6e9698d988d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T08:06:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T08:06:29.000Z",
      "valid_until": "2026-05-03T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T07:33:47.093Z",
      "x_nadsec_last_seen": "2026-04-23T15:11:09.906Z",
      "x_nadsec_ports": [
        "445",
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-01T08:06:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--5dba5369-3f65-4d25-a851-d458d4cf809a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T08:06:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.14.25.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T08:06:29.000Z",
      "valid_until": "2026-05-03T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T08:04:48.357Z",
      "x_nadsec_last_seen": "2026-04-30T20:56:38.860Z",
      "x_nadsec_ports": [
        "21",
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-04-01T08:06:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--93d1ec11-17ca-4f23-993e-d89b2b292e7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T08:06:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.77.35.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T08:06:29.000Z",
      "valid_until": "2026-05-03T08:05:09.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-04-01T07:17:12.670Z",
      "x_nadsec_last_seen": "2026-04-01T07:19:13.677Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-01T08:06:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=OM; asn=204170; asn_org=Awaser Oman LLC; user(top)=**",
      "id": "indicator--5e184202-3545-48df-b98c-6f1c0a7e2aa6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T08:06:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '38.253.208.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T08:06:29.000Z",
      "valid_until": "2026-05-03T08:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-01T07:55:45.889Z",
      "x_nadsec_last_seen": "2026-04-08T17:12:36.748Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "OM"
      ],
      "x_nadsec_asns": [
        "204170"
      ],
      "x_nadsec_orgs": [
        "Awaser Oman LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-01T08:06:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TN; asn=37705; asn_org=TOPNET",
      "id": "indicator--28e7d3df-eb96-4ec5-b8b3-cd42398c8165",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T08:06:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.230.60.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T08:06:29.000Z",
      "valid_until": "2026-05-03T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T07:24:20.142Z",
      "x_nadsec_last_seen": "2026-04-17T00:30:42.039Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37705"
      ],
      "x_nadsec_orgs": [
        "TOPNET"
      ]
    },
    {
      "created": "2026-04-01T08:06:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--04c7d252-f36c-4afe-8f77-b89166e955c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T08:06:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.254.192.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T08:06:29.000Z",
      "valid_until": "2026-05-03T08:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-01T07:25:41.541Z",
      "x_nadsec_last_seen": "2026-04-01T07:26:08.005Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-01T08:06:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SC; asn=206264; asn_org=Amarutu Technology Ltd",
      "id": "indicator--07243cf2-0793-4c7b-baed-4152f2fe4e80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T08:06:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.61.209.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T08:06:29.000Z",
      "valid_until": "2026-05-03T08:05:09.000Z",
      "x_nadsec_event_count": 60,
      "x_nadsec_first_seen": "2026-04-01T07:20:54.597Z",
      "x_nadsec_last_seen": "2026-04-30T22:30:04.985Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "206264"
      ],
      "x_nadsec_orgs": [
        "Amarutu Technology Ltd"
      ]
    },
    {
      "created": "2026-04-01T08:06:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--e9cb47f7-961a-48d1-9929-200611358fc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T08:06:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T08:06:29.000Z",
      "valid_until": "2026-05-03T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-01T07:38:35.515Z",
      "x_nadsec_last_seen": "2026-04-25T12:35:08.683Z",
      "x_nadsec_ports": [
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-01T08:06:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--213ec726-fa41-43d0-b73f-f7bfea8d2b7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T08:06:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T08:06:29.000Z",
      "valid_until": "2026-05-03T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T07:31:30.876Z",
      "x_nadsec_last_seen": "2026-04-01T07:31:30.876Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-01T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BA; asn=9146; asn_org=BH Telecom d.d. Sarajevo",
      "id": "indicator--bbe1bbaf-8fd6-41ea-aa27-33209409c3d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '109.163.144.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T09:05:02.000Z",
      "valid_until": "2026-05-03T09:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T09:01:48.583Z",
      "x_nadsec_last_seen": "2026-04-01T09:03:54.632Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BA"
      ],
      "x_nadsec_asns": [
        "9146"
      ],
      "x_nadsec_orgs": [
        "BH Telecom d.d. Sarajevo"
      ]
    },
    {
      "created": "2026-04-01T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--0e20ba88-c146-45c5-a5c1-7c334ddb29bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '119.93.198.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T09:05:02.000Z",
      "valid_until": "2026-05-03T09:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T08:56:56.757Z",
      "x_nadsec_last_seen": "2026-04-01T08:59:01.435Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-04-01T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--0b81bb7d-8f38-4e87-b414-b22bb3376e1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.233.112.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T09:05:02.000Z",
      "valid_until": "2026-05-03T09:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T08:33:38.240Z",
      "x_nadsec_last_seen": "2026-04-07T18:47:25.395Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-01T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--89d2539f-0635-4859-8af2-0e3400bd14bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.190.94.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T09:05:02.000Z",
      "valid_until": "2026-05-03T09:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T08:44:15.973Z",
      "x_nadsec_last_seen": "2026-04-01T08:47:31.763Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-01T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--f83ec7d2-49bb-45fa-9bf0-c6cdfbd724cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.211.13.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T09:05:02.000Z",
      "valid_until": "2026-05-03T09:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T08:51:54.638Z",
      "x_nadsec_last_seen": "2026-04-01T08:54:02.488Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-01T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--33928a4d-7a40-40b0-8ad2-7ca07fd899a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T09:05:02.000Z",
      "valid_until": "2026-05-03T09:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T08:55:41.580Z",
      "x_nadsec_last_seen": "2026-04-01T08:55:41.580Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-01T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--2f469d99-b5d1-4135-9818-b6acead54128",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T09:05:02.000Z",
      "valid_until": "2026-05-03T09:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T08:55:41.292Z",
      "x_nadsec_last_seen": "2026-04-01T08:55:41.292Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-01T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--6d074322-278a-4fa9-bffa-b8487a891c4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T09:05:02.000Z",
      "valid_until": "2026-05-03T09:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T08:45:30.162Z",
      "x_nadsec_last_seen": "2026-04-01T08:45:30.162Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-01T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--ec2ae5b6-f187-430d-bac5-9fe29d521dc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '207.154.228.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T09:05:02.000Z",
      "valid_until": "2026-05-03T09:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T08:22:15.736Z",
      "x_nadsec_last_seen": "2026-04-01T08:22:15.736Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-01T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--08bf9ee2-b8a5-429e-b140-d106d734d225",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '223.205.211.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T09:05:02.000Z",
      "valid_until": "2026-05-03T09:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T09:02:27.719Z",
      "x_nadsec_last_seen": "2026-04-01T09:04:32.235Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-04-01T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--eb5fc83b-44fa-45a2-9154-47bd7412911a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T09:05:02.000Z",
      "valid_until": "2026-05-03T09:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T08:14:42.600Z",
      "x_nadsec_last_seen": "2026-04-01T08:14:42.600Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-04-01T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--4a09cb11-3cdf-4e86-a166-0e81ff4623bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T09:05:02.000Z",
      "valid_until": "2026-05-03T09:05:00.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-04-01T08:14:45.117Z",
      "x_nadsec_last_seen": "2026-04-18T21:57:42.538Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-04-01T10:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--f8f95650-d614-431d-8f64-10c4108380f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T10:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.164.117.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T10:05:32.000Z",
      "valid_until": "2026-05-03T10:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-01T09:54:11.835Z",
      "x_nadsec_last_seen": "2026-04-01T10:01:06.688Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-01T10:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=IN; asn=45184; asn_org=Den Digital Entertainment Pvt. Ltd. AS ISP india",
      "id": "indicator--f86bb645-7a45-453c-a74b-28abba15209e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T10:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '112.196.143.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T10:05:32.000Z",
      "valid_until": "2026-05-03T10:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-01T09:28:11.301Z",
      "x_nadsec_last_seen": "2026-04-01T09:45:33.442Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45184"
      ],
      "x_nadsec_orgs": [
        "Den Digital Entertainment Pvt. Ltd. AS ISP india"
      ]
    },
    {
      "created": "2026-04-01T10:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--e4a4dcdf-cd5a-4cf2-84a3-63199a182ce4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T10:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.173.66.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T10:05:32.000Z",
      "valid_until": "2026-05-03T10:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T09:18:47.299Z",
      "x_nadsec_last_seen": "2026-04-01T09:20:52.352Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-04-01T10:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--970f53c2-7b3e-4637-8a73-48ed05d4cabb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T10:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '134.122.68.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T10:05:32.000Z",
      "valid_until": "2026-05-03T10:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-01T09:34:44.913Z",
      "x_nadsec_last_seen": "2026-04-01T09:34:45.887Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-01T10:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=20978; asn_org=TT Mobil Iletisim Hizmetleri A.S",
      "id": "indicator--1675bd2d-ae29-44c9-8f8f-5b9a94632bda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T10:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.220.57.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T10:05:32.000Z",
      "valid_until": "2026-05-03T10:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T10:00:18.828Z",
      "x_nadsec_last_seen": "2026-04-01T10:02:25.855Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "20978"
      ],
      "x_nadsec_orgs": [
        "TT Mobil Iletisim Hizmetleri A.S"
      ]
    },
    {
      "created": "2026-04-01T10:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--f3ef22c0-40db-45d7-972f-618c8e0f57ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T10:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T10:05:32.000Z",
      "valid_until": "2026-05-03T10:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T09:52:00.595Z",
      "x_nadsec_last_seen": "2026-04-01T09:52:00.595Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-01T10:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--909bf079-371c-45b6-b52b-5c82a2714569",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T10:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.73.250.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T10:05:32.000Z",
      "valid_until": "2026-05-03T10:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T09:18:32.542Z",
      "x_nadsec_last_seen": "2026-04-01T09:20:38.362Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-01T10:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=KE; asn=37219; asn_org=ICTA",
      "id": "indicator--9a2d189a-7d5f-4f52-822b-d1b11bcb3fa3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T10:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.76.168.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T10:05:32.000Z",
      "valid_until": "2026-05-03T10:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T10:04:09.959Z",
      "x_nadsec_last_seen": "2026-04-01T10:08:56.963Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "37219"
      ],
      "x_nadsec_orgs": [
        "ICTA"
      ]
    },
    {
      "created": "2026-04-01T10:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=18; services=mirrord; ports=42; cc=DE; asn=212512; asn_org=Detai Prosperous Technologies Limited",
      "id": "indicator--2505a098-300b-4d24-920a-048ca2c1439a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T10:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T10:05:32.000Z",
      "valid_until": "2026-05-03T10:05:08.000Z",
      "x_nadsec_event_count": 23,
      "x_nadsec_first_seen": "2026-04-01T09:24:28.603Z",
      "x_nadsec_last_seen": "2026-04-05T09:44:22.108Z",
      "x_nadsec_ports": [
        "42",
        "1433",
        "34241",
        "36659",
        "36987",
        "37335",
        "39717",
        "39947",
        "41943",
        "44101"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "212512"
      ],
      "x_nadsec_orgs": [
        "Detai Prosperous Technologies Limited"
      ]
    },
    {
      "created": "2026-04-01T10:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--b7ce0d24-bc4a-4d77-872f-56724c402348",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T10:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T10:05:32.000Z",
      "valid_until": "2026-05-03T10:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-01T10:03:02.885Z",
      "x_nadsec_last_seen": "2026-04-30T12:36:23.162Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-01T10:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=11525; asn_org=Hancock Rural Telephone Corp.",
      "id": "indicator--dcdb0fe6-098c-40ef-b806-1128c11dccfa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T10:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.112.114.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T10:05:32.000Z",
      "valid_until": "2026-05-03T10:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T09:59:39.096Z",
      "x_nadsec_last_seen": "2026-04-01T10:01:44.202Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "11525"
      ],
      "x_nadsec_orgs": [
        "Hancock Rural Telephone Corp."
      ]
    },
    {
      "created": "2026-04-01T10:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--b4208529-a600-4664-a1a6-319c4a7e4daf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T10:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '81.214.132.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T10:05:32.000Z",
      "valid_until": "2026-05-03T10:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-01T10:02:16.063Z",
      "x_nadsec_last_seen": "2026-04-01T10:09:24.361Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-01T10:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=48409; asn_org=NTK Ltd.",
      "id": "indicator--66b85c25-fad2-40a1-bd03-7da681164d22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T10:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.207.238.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T10:05:32.000Z",
      "valid_until": "2026-05-03T10:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T09:45:36.853Z",
      "x_nadsec_last_seen": "2026-04-01T09:47:43.645Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48409"
      ],
      "x_nadsec_orgs": [
        "NTK Ltd."
      ]
    },
    {
      "created": "2026-04-01T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--86ab658b-fc50-4da5-98c4-f37da2978186",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.149.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:05:05.000Z",
      "valid_until": "2026-05-03T12:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T11:32:59.710Z",
      "x_nadsec_last_seen": "2026-04-01T11:32:59.710Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-01T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=ftpd; ports=21; cc=US; asn=5650; asn_org=Frontier Communications of America, Inc.",
      "id": "indicator--13c7dbe2-ddab-4eb0-8058-3f7d9651aa8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.99.61.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:05:05.000Z",
      "valid_until": "2026-05-03T12:05:04.000Z",
      "x_nadsec_event_count": 35,
      "x_nadsec_first_seen": "2026-04-01T11:48:45.839Z",
      "x_nadsec_last_seen": "2026-04-29T10:14:09.395Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "1433",
        "3306",
        "36353",
        "39507",
        "44371",
        "44565"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "5650"
      ],
      "x_nadsec_orgs": [
        "Frontier Communications of America, Inc."
      ]
    },
    {
      "created": "2026-04-01T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--3fdcf511-d7c5-4ba5-bf14-9c34f33da699",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.128.7.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:05:05.000Z",
      "valid_until": "2026-05-03T12:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T11:32:57.534Z",
      "x_nadsec_last_seen": "2026-04-01T11:32:57.534Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-01T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=28840; asn_org=Pjsc tattelecom",
      "id": "indicator--3726b96e-4ecd-4dcf-a773-1320038d1648",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.205.101.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:05:05.000Z",
      "valid_until": "2026-05-03T12:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T11:03:36.063Z",
      "x_nadsec_last_seen": "2026-04-01T11:05:42.848Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "28840"
      ],
      "x_nadsec_orgs": [
        "Pjsc tattelecom"
      ]
    },
    {
      "created": "2026-04-01T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--5f920d5b-8cda-4846-a87a-5b6f3972d160",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '187.212.168.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:05:05.000Z",
      "valid_until": "2026-05-03T12:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-01T11:31:00.630Z",
      "x_nadsec_last_seen": "2026-04-01T11:31:00.719Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-04-01T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=32098; asn_org=Transtelco Inc",
      "id": "indicator--b697052c-d231-40fa-9654-44fd115494d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '187.249.120.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:05:05.000Z",
      "valid_until": "2026-05-03T12:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-01T12:01:02.374Z",
      "x_nadsec_last_seen": "2026-04-01T12:07:39.391Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "32098"
      ],
      "x_nadsec_orgs": [
        "Transtelco Inc"
      ]
    },
    {
      "created": "2026-04-01T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=20485; asn_org=Joint Stock Company TransTeleCom",
      "id": "indicator--43ff2ade-52aa-4879-a9b2-350ec0b44a0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '188.43.245.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:05:05.000Z",
      "valid_until": "2026-05-03T12:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T10:55:10.658Z",
      "x_nadsec_last_seen": "2026-04-01T11:08:19.961Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "20485"
      ],
      "x_nadsec_orgs": [
        "Joint Stock Company TransTeleCom"
      ]
    },
    {
      "created": "2026-04-01T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--8bb3732b-822c-45c2-8f24-64fc4bd71509",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:05:05.000Z",
      "valid_until": "2026-05-03T12:05:04.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-04-01T11:09:47.445Z",
      "x_nadsec_last_seen": "2026-04-26T21:56:02.183Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-04-01T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=48642; asn_org=Joint stock company For",
      "id": "indicator--71894884-b42a-4b55-89d9-1af827ce5fab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.36.23.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:05:05.000Z",
      "valid_until": "2026-05-03T12:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T12:03:49.942Z",
      "x_nadsec_last_seen": "2026-04-01T12:05:56.640Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48642"
      ],
      "x_nadsec_orgs": [
        "Joint stock company For"
      ]
    },
    {
      "created": "2026-04-01T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--ede08bf6-4651-4414-9cbc-1111e268bbc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.23.193.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:05:05.000Z",
      "valid_until": "2026-05-03T12:05:04.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-01T11:54:29.420Z",
      "x_nadsec_last_seen": "2026-04-01T11:58:32.627Z",
      "x_nadsec_ports": [
        "42",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "34081"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd",
        "mirrorc",
        "mirrord",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-01T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--d3b3447c-ab29-48aa-aacf-8bf3e358df24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:05:05.000Z",
      "valid_until": "2026-05-03T12:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-01T11:10:53.454Z",
      "x_nadsec_last_seen": "2026-04-05T14:29:35.263Z",
      "x_nadsec_ports": [
        "21",
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-01T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--e053c474-e851-4794-bbc0-2c7cf3b01347",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:05:05.000Z",
      "valid_until": "2026-05-03T12:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T11:05:13.450Z",
      "x_nadsec_last_seen": "2026-04-01T11:05:13.450Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-01T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited; user(top)=**",
      "id": "indicator--444dbf39-002d-4f75-8623-5c3544498b63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '110.164.130.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T13:05:10.000Z",
      "valid_until": "2026-05-03T13:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T12:39:25.061Z",
      "x_nadsec_last_seen": "2026-04-01T12:39:25.061Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-01T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--0f89ed3c-fb0a-4cf8-a9c2-13e07ebe352c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.97.159.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T13:05:10.000Z",
      "valid_until": "2026-05-03T13:05:08.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-04-01T13:00:34.870Z",
      "x_nadsec_last_seen": "2026-04-01T13:02:43.540Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-04-01T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=37340; asn_org=Spectranet",
      "id": "indicator--bb8e6496-4486-4b41-a8f1-6793cf8aad43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.118.32.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T13:05:10.000Z",
      "valid_until": "2026-05-03T13:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T12:24:21.670Z",
      "x_nadsec_last_seen": "2026-04-01T12:26:29.690Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "37340"
      ],
      "x_nadsec_orgs": [
        "Spectranet"
      ]
    },
    {
      "created": "2026-04-01T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--e1022e2c-8ae8-4cc6-9fc4-c5f40d02923a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.242.84.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T13:05:10.000Z",
      "valid_until": "2026-05-03T13:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-01T12:10:28.741Z",
      "x_nadsec_last_seen": "2026-04-01T12:10:28.773Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-04-01T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BO; asn=26210; asn_org=AXS Bolivia S. A.",
      "id": "indicator--b2dd1b72-0c40-4dbd-bd2d-c1c611b1db84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.121.201.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T13:05:10.000Z",
      "valid_until": "2026-05-03T13:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T12:50:21.590Z",
      "x_nadsec_last_seen": "2026-04-01T12:50:28.669Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "26210"
      ],
      "x_nadsec_orgs": [
        "AXS Bolivia S. A."
      ]
    },
    {
      "created": "2026-04-01T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=27699; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--56fb010a-38e1-4927-b5cd-cc6384555213",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '200.161.56.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T13:05:10.000Z",
      "valid_until": "2026-05-03T13:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-01T12:42:16.207Z",
      "x_nadsec_last_seen": "2026-04-01T12:49:36.314Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "27699"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-04-01T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--a13e15bf-5503-4fd5-b783-dda0038db0e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '203.99.187.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T13:05:10.000Z",
      "valid_until": "2026-05-03T13:05:08.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-01T12:05:32.483Z",
      "x_nadsec_last_seen": "2026-04-10T10:23:42.931Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-04-01T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=52436; asn_org=Cable Televisora Color",
      "id": "indicator--54d9c037-23a2-4df6-9cae-e2e7594a1321",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '207.248.126.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T13:05:10.000Z",
      "valid_until": "2026-05-03T13:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T12:47:53.769Z",
      "x_nadsec_last_seen": "2026-04-01T12:50:00.499Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "52436"
      ],
      "x_nadsec_orgs": [
        "Cable Televisora Color"
      ]
    },
    {
      "created": "2026-04-01T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--4ed88d92-c020-46ad-9bf4-bbb7100f7706",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T13:05:10.000Z",
      "valid_until": "2026-05-03T13:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-01T12:21:08.133Z",
      "x_nadsec_last_seen": "2026-04-23T12:22:14.215Z",
      "x_nadsec_ports": [
        "21",
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-01T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--aae1fbeb-ded2-458e-a0cb-bfc0057643db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T13:05:10.000Z",
      "valid_until": "2026-05-03T13:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-01T12:17:56.074Z",
      "x_nadsec_last_seen": "2026-04-09T13:30:52.308Z",
      "x_nadsec_ports": [
        "1723",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-01T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--9680d567-2b3d-4c7e-a94f-e15eb8f4f636",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T13:05:10.000Z",
      "valid_until": "2026-05-03T13:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-01T12:21:53.738Z",
      "x_nadsec_last_seen": "2026-04-02T00:58:38.683Z",
      "x_nadsec_ports": [
        "81",
        "1723"
      ],
      "x_nadsec_services": [
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-01T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--09e2cc53-7c79-4d17-968b-90fa3aaed4e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '8.222.181.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T13:05:10.000Z",
      "valid_until": "2026-05-03T13:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-01T12:25:53.481Z",
      "x_nadsec_last_seen": "2026-04-16T01:38:06.860Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-01T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=24835; asn_org=RAYA Telecom - Egypt",
      "id": "indicator--056aa22c-dbda-4fe1-98a5-8a40b2ae7f32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.185.227.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T14:05:10.000Z",
      "valid_until": "2026-05-03T14:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-01T13:29:25.699Z",
      "x_nadsec_last_seen": "2026-04-01T13:29:25.995Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24835"
      ],
      "x_nadsec_orgs": [
        "RAYA Telecom - Egypt"
      ]
    },
    {
      "created": "2026-04-01T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ZA; asn=37457; asn_org=Telkom-Internet",
      "id": "indicator--ede4d838-9012-4276-8bcd-025b28da3699",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '105.184.84.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T14:05:10.000Z",
      "valid_until": "2026-05-03T14:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-01T13:38:25.419Z",
      "x_nadsec_last_seen": "2026-04-01T13:40:31.162Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "37457"
      ],
      "x_nadsec_orgs": [
        "Telkom-Internet"
      ]
    },
    {
      "created": "2026-04-01T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--337d46fa-17e9-4496-a094-ba40813a3925",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T14:05:10.000Z",
      "valid_until": "2026-05-03T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T13:20:06.612Z",
      "x_nadsec_last_seen": "2026-04-01T13:22:14.001Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-04-01T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--0c600559-d225-4a85-9a74-d00a2a38ab5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T14:05:10.000Z",
      "valid_until": "2026-05-03T14:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-04-01T14:03:40.452Z",
      "x_nadsec_last_seen": "2026-04-24T21:51:20.562Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-04-01T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=133481; asn_org=AIS Fibre",
      "id": "indicator--73b01646-8e8c-4656-9596-c1117dac5d35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.82.92.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T14:05:10.000Z",
      "valid_until": "2026-05-03T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T13:57:30.537Z",
      "x_nadsec_last_seen": "2026-04-01T13:57:35.022Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "133481"
      ],
      "x_nadsec_orgs": [
        "AIS Fibre"
      ]
    },
    {
      "created": "2026-04-01T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--a5e0d6f9-66e6-47ec-8209-b6757d9cb3ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T14:05:10.000Z",
      "valid_until": "2026-05-03T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T13:52:51.387Z",
      "x_nadsec_last_seen": "2026-04-01T13:52:51.387Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-04-01T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=28539; asn_org=JOSE MIGUEL MACIAS CONTRERAS",
      "id": "indicator--f5a522c3-9635-4d23-baa3-cb22dde04af3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '201.159.110.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T14:05:10.000Z",
      "valid_until": "2026-05-03T14:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-01T13:35:48.687Z",
      "x_nadsec_last_seen": "2026-04-01T13:40:37.795Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "28539"
      ],
      "x_nadsec_orgs": [
        "JOSE MIGUEL MACIAS CONTRERAS"
      ]
    },
    {
      "created": "2026-04-01T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=24945; asn_org=Telecommunication Company Vinteleport Ltd.",
      "id": "indicator--c748b2cc-0da8-4590-85ef-5becc37884fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.72.44.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T14:05:10.000Z",
      "valid_until": "2026-05-03T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T13:14:59.950Z",
      "x_nadsec_last_seen": "2026-04-01T13:17:05.957Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "24945"
      ],
      "x_nadsec_orgs": [
        "Telecommunication Company Vinteleport Ltd."
      ]
    },
    {
      "created": "2026-04-01T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--91436eca-c96e-4bb2-b447-4f0ab8da8a60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T14:05:10.000Z",
      "valid_until": "2026-05-03T14:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-01T13:11:17.792Z",
      "x_nadsec_last_seen": "2026-04-21T16:03:44.084Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-01T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--e5bea4fa-d8dd-4b68-a473-dceba64d0142",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T14:05:10.000Z",
      "valid_until": "2026-05-03T14:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-01T13:53:05.232Z",
      "x_nadsec_last_seen": "2026-04-21T15:10:06.480Z",
      "x_nadsec_ports": [
        "445",
        "135",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper",
        "mongod",
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-01T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--db6259dc-b499-4c6e-beb7-a06a3de5fe33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '115.74.241.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T15:05:02.000Z",
      "valid_until": "2026-05-03T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T14:23:13.978Z",
      "x_nadsec_last_seen": "2026-04-01T14:25:18.836Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-01T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--852ea53f-c91d-43e6-bc5f-2b0efba7a0e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '13.86.105.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T15:05:02.000Z",
      "valid_until": "2026-05-03T15:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-01T14:45:09.376Z",
      "x_nadsec_last_seen": "2026-04-01T14:45:19.551Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-01T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=JP; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--d5b30679-0fa1-445a-9285-d1fb308b002f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '139.162.117.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T15:05:02.000Z",
      "valid_until": "2026-05-03T15:05:01.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-04-01T14:22:03.324Z",
      "x_nadsec_last_seen": "2026-04-28T21:18:50.600Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-01T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=13999; asn_org=Mega Cable, S.A. de C.V.",
      "id": "indicator--2c2a5f4c-08bf-47d8-bf84-931054b2f0ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '187.246.129.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T15:05:02.000Z",
      "valid_until": "2026-05-03T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T14:46:51.262Z",
      "x_nadsec_last_seen": "2026-04-01T14:46:56.200Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "13999"
      ],
      "x_nadsec_orgs": [
        "Mega Cable, S.A. de C.V."
      ]
    },
    {
      "created": "2026-04-01T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AR; asn=11014; asn_org=CPS",
      "id": "indicator--72563dd9-6b26-4e65-b996-2fa13ddf39eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.104.195.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T15:05:02.000Z",
      "valid_until": "2026-05-03T15:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-01T14:45:15.699Z",
      "x_nadsec_last_seen": "2026-04-01T14:47:23.187Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "11014"
      ],
      "x_nadsec_orgs": [
        "CPS"
      ]
    },
    {
      "created": "2026-04-01T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--a031bcbb-869d-4da3-8846-2d29f1ee4e87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T15:05:02.000Z",
      "valid_until": "2026-05-03T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T14:42:40.415Z",
      "x_nadsec_last_seen": "2026-04-01T14:42:40.415Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-01T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--7c8550e4-1c8a-4d87-9779-5d245e2e7fe3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T15:05:02.000Z",
      "valid_until": "2026-05-03T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T14:42:40.775Z",
      "x_nadsec_last_seen": "2026-04-01T14:42:40.775Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-01T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--f0748849-658e-4bf7-bc48-408dc19ab6da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T15:05:02.000Z",
      "valid_until": "2026-05-03T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T14:43:08.046Z",
      "x_nadsec_last_seen": "2026-04-01T14:43:08.046Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-01T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--61fcc6e1-18d9-463f-8dde-ca7b2ebfdef2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T15:05:02.000Z",
      "valid_until": "2026-05-03T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T14:43:07.535Z",
      "x_nadsec_last_seen": "2026-04-01T14:43:07.535Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-01T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AR; asn=16814; asn_org=NSS S.A.",
      "id": "indicator--997f6d04-72bb-4341-811e-060898241047",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '200.61.183.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T15:05:02.000Z",
      "valid_until": "2026-05-03T15:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-01T14:45:16.106Z",
      "x_nadsec_last_seen": "2026-04-01T14:47:21.144Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "16814"
      ],
      "x_nadsec_orgs": [
        "NSS S.A."
      ]
    },
    {
      "created": "2026-04-01T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--ed43d389-8353-4756-92aa-1dbee91ae1c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.141.84.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T15:05:02.000Z",
      "valid_until": "2026-05-03T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T14:11:43.676Z",
      "x_nadsec_last_seen": "2026-04-01T14:13:50.424Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-01T17:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31257; asn_org=Orion Telecom LLC",
      "id": "indicator--f6862cad-bdc9-4ae4-b020-12ada9e9b4d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T17:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '109.226.252.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T17:05:21.000Z",
      "valid_until": "2026-05-03T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T16:19:07.606Z",
      "x_nadsec_last_seen": "2026-04-01T16:21:14.684Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31257"
      ],
      "x_nadsec_orgs": [
        "Orion Telecom LLC"
      ]
    },
    {
      "created": "2026-04-01T17:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=45769; asn_org=D-Vois Broadband Pvt Ltd",
      "id": "indicator--daad5f9a-cd82-4cb1-a33a-a1a7f9edbb61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T17:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '111.125.227.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T17:05:21.000Z",
      "valid_until": "2026-05-03T17:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-01T16:41:33.141Z",
      "x_nadsec_last_seen": "2026-04-01T16:43:40.372Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45769"
      ],
      "x_nadsec_orgs": [
        "D-Vois Broadband Pvt Ltd"
      ]
    },
    {
      "created": "2026-04-01T17:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b9393dde-4ae7-4e26-af73-d81d37f89a47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T17:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T17:05:21.000Z",
      "valid_until": "2026-05-03T17:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-01T16:19:43.433Z",
      "x_nadsec_last_seen": "2026-04-02T19:52:00.112Z",
      "x_nadsec_ports": [
        "21",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-01T17:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=VE; asn=11562; asn_org=Net Uno, C.A.",
      "id": "indicator--e61f5157-c377-4969-98f6-9e0eced07975",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T17:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.6.9.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T17:05:21.000Z",
      "valid_until": "2026-05-03T17:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-04-01T16:59:00.663Z",
      "x_nadsec_last_seen": "2026-04-01T20:48:22.576Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "11562"
      ],
      "x_nadsec_orgs": [
        "Net Uno, C.A."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "0****9"
      ]
    },
    {
      "created": "2026-04-01T17:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--ed0a506b-c46f-41e4-a5a6-0671d9499e2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T17:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T17:05:21.000Z",
      "valid_until": "2026-05-03T17:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-01T16:36:56.232Z",
      "x_nadsec_last_seen": "2026-04-23T03:57:39.855Z",
      "x_nadsec_ports": [
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-01T17:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=10429; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--c6eb07cb-86bc-459b-b925-161c1a110b22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T17:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '200.205.127.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T17:05:21.000Z",
      "valid_until": "2026-05-03T17:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-01T16:11:46.632Z",
      "x_nadsec_last_seen": "2026-04-01T16:11:51.513Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "10429"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-04-01T17:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KH; asn=38235; asn_org=ANGKOR DATA COMMUNICATION",
      "id": "indicator--0d1f328c-6d31-4eae-97fc-3c0190c46f17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T17:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '203.176.138.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T17:05:21.000Z",
      "valid_until": "2026-05-03T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T16:37:35.731Z",
      "x_nadsec_last_seen": "2026-04-01T16:39:40.372Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KH"
      ],
      "x_nadsec_asns": [
        "38235"
      ],
      "x_nadsec_orgs": [
        "ANGKOR DATA COMMUNICATION"
      ]
    },
    {
      "created": "2026-04-01T17:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=209788; asn_org=LLC Cifrovie Seti Urala",
      "id": "indicator--b9a7e811-9c0d-4e9d-8356-d8ddaf3119c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T17:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '95.183.46.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T17:05:21.000Z",
      "valid_until": "2026-05-03T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T16:59:33.370Z",
      "x_nadsec_last_seen": "2026-04-01T17:01:39.996Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "209788"
      ],
      "x_nadsec_orgs": [
        "LLC Cifrovie Seti Urala"
      ]
    },
    {
      "created": "2026-04-01T18:05:38.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--4fe7e189-0150-4b4b-9ba9-44c31e5c587b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T18:05:38.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.161.144.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T18:05:38.000Z",
      "valid_until": "2026-05-03T18:05:09.000Z",
      "x_nadsec_event_count": 21,
      "x_nadsec_first_seen": "2026-04-01T17:08:14.042Z",
      "x_nadsec_last_seen": "2026-04-28T15:58:15.123Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-01T18:05:38.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--69d59bac-bffd-4de4-8ac4-a7bfab7700c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T18:05:38.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.190.244.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T18:05:38.000Z",
      "valid_until": "2026-05-03T18:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-01T17:16:09.265Z",
      "x_nadsec_last_seen": "2026-04-30T01:35:41.965Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-01T18:05:38.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17762; asn_org=Tata Teleservices Maharashtra Ltd",
      "id": "indicator--06fa553d-0701-48d7-8c39-fa574142e950",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T18:05:38.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '123.252.206.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T18:05:38.000Z",
      "valid_until": "2026-05-03T18:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-01T17:35:35.633Z",
      "x_nadsec_last_seen": "2026-04-10T15:53:30.776Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17762"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices Maharashtra Ltd"
      ]
    },
    {
      "created": "2026-04-01T18:05:38.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=22; services=ftpd; ports=21; cc=GB; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--837a7d39-53d1-45c7-86c3-41f0557a0d8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T18:05:38.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.93.39.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T18:05:38.000Z",
      "valid_until": "2026-05-03T18:05:09.000Z",
      "x_nadsec_event_count": 22,
      "x_nadsec_first_seen": "2026-04-01T18:01:57.694Z",
      "x_nadsec_last_seen": "2026-04-01T18:02:13.624Z",
      "x_nadsec_ports": [
        "445",
        "1883",
        "3306",
        "27017",
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "mongod",
        "mqttd",
        "mysqld",
        "smbd",
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-01T18:05:38.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CO; asn=3816; asn_org=COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "id": "indicator--333f863e-1c83-4a99-a548-a8190b55624c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T18:05:38.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.200.165.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T18:05:38.000Z",
      "valid_until": "2026-05-03T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T17:22:44.113Z",
      "x_nadsec_last_seen": "2026-04-01T17:22:44.113Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "3816"
      ],
      "x_nadsec_orgs": [
        "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC"
      ]
    },
    {
      "created": "2026-04-01T18:05:38.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=IN; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--7430fa29-7cbc-446a-a426-92eb410c1ddb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T18:05:38.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.156.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T18:05:38.000Z",
      "valid_until": "2026-05-03T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T17:55:06.663Z",
      "x_nadsec_last_seen": "2026-04-01T17:55:35.458Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-01T18:05:38.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=AM; asn=197834; asn_org=Ucom CJSC",
      "id": "indicator--2c9dde4a-5ba1-4b84-bae7-3a5d0d44e170",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T18:05:38.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.32.193.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T18:05:38.000Z",
      "valid_until": "2026-05-03T18:05:09.000Z",
      "x_nadsec_event_count": 18,
      "x_nadsec_first_seen": "2026-04-01T17:05:32.155Z",
      "x_nadsec_last_seen": "2026-04-30T05:59:41.874Z",
      "x_nadsec_ports": [
        "27017",
        "3306",
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld",
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "197834"
      ],
      "x_nadsec_orgs": [
        "Ucom CJSC"
      ]
    },
    {
      "created": "2026-04-01T18:05:38.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=UA; asn=29107; asn_org=Synapse Network LTD; user(top)=**",
      "id": "indicator--b772252c-bcb3-496e-9dbf-e665d7ba0a1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T18:05:38.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.54.78.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T18:05:38.000Z",
      "valid_until": "2026-05-03T18:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-01T18:04:44.703Z",
      "x_nadsec_last_seen": "2026-04-22T00:16:03.541Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "29107"
      ],
      "x_nadsec_orgs": [
        "Synapse Network LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-01T18:05:38.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH",
      "id": "indicator--1ea0a2f5-3c76-48ef-b55b-a6e960f175c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T18:05:38.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T18:05:38.000Z",
      "valid_until": "2026-05-03T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T17:23:04.850Z",
      "x_nadsec_last_seen": "2026-04-01T17:23:04.850Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "215778"
      ],
      "x_nadsec_orgs": [
        "Alpha Strike Labs GmbH"
      ]
    },
    {
      "created": "2026-04-01T18:05:38.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH",
      "id": "indicator--9f20f149-0ef4-4dca-97e0-c643e079738e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T18:05:38.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T18:05:38.000Z",
      "valid_until": "2026-05-03T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T17:23:04.399Z",
      "x_nadsec_last_seen": "2026-04-01T17:23:04.399Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "215778"
      ],
      "x_nadsec_orgs": [
        "Alpha Strike Labs GmbH"
      ]
    },
    {
      "created": "2026-04-01T18:05:38.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--7f3e8252-9788-4b7f-ae39-27680ce0b349",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T18:05:38.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T18:05:38.000Z",
      "valid_until": "2026-05-03T18:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-01T17:33:01.033Z",
      "x_nadsec_last_seen": "2026-04-30T06:31:26.741Z",
      "x_nadsec_ports": [
        "1433",
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-01T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=mssqld; ports=1433; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--37d869a9-bec9-41cb-aebe-bcf710772d97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '114.38.215.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:05:10.000Z",
      "valid_until": "2026-05-03T19:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-04-01T18:10:14.670Z",
      "x_nadsec_last_seen": "2026-04-01T18:11:45.684Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "!*******e"
      ]
    },
    {
      "created": "2026-04-01T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; user(top)=**",
      "id": "indicator--29df78dc-5d9c-403a-bd85-2e105be52f3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '123.138.18.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:05:10.000Z",
      "valid_until": "2026-05-03T19:05:09.000Z",
      "x_nadsec_event_count": 32,
      "x_nadsec_first_seen": "2026-04-01T18:08:43.153Z",
      "x_nadsec_last_seen": "2026-04-29T20:40:31.891Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-01T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=VN; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--fc058976-0b90-4df7-96cb-0a7315db9f7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.249.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:05:10.000Z",
      "valid_until": "2026-05-03T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-01T18:18:47.855Z",
      "x_nadsec_last_seen": "2026-04-01T18:19:11.186Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-01T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=NG; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--2444d111-1635-4c3e-9486-1d92be0434a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.10.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:05:10.000Z",
      "valid_until": "2026-05-03T19:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-01T18:56:47.601Z",
      "x_nadsec_last_seen": "2026-04-23T19:16:17.774Z",
      "x_nadsec_ports": [
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-01T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--abbb9b33-1484-4925-9dff-b971832eb102",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.236.77.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:05:10.000Z",
      "valid_until": "2026-05-03T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T18:11:38.387Z",
      "x_nadsec_last_seen": "2026-04-01T18:16:29.666Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-04-01T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--e87928c4-972c-4a05-8fef-cb0a404ac928",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.88.246.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:05:10.000Z",
      "valid_until": "2026-05-03T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T18:44:30.904Z",
      "x_nadsec_last_seen": "2026-04-01T18:44:37.342Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-04-01T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=124; services=smbd; ports=445; cc=GB; asn=201579; asn_org=Hostgnome Ltd",
      "id": "indicator--e83909fb-cc4e-4ac6-84bd-84ae9bf82ab0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.91.69.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:05:10.000Z",
      "valid_until": "2026-05-03T19:05:09.000Z",
      "x_nadsec_event_count": 268,
      "x_nadsec_first_seen": "2026-04-01T18:27:30.015Z",
      "x_nadsec_last_seen": "2026-04-03T07:37:07.273Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "201579"
      ],
      "x_nadsec_orgs": [
        "Hostgnome Ltd"
      ]
    },
    {
      "created": "2026-04-01T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BR; asn=16735; asn_org=ALGAR TELECOM SA",
      "id": "indicator--70cc8b55-368c-44c1-ba3d-2edf18e4744a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '187.32.146.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:05:10.000Z",
      "valid_until": "2026-05-03T19:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-01T19:03:43.480Z",
      "x_nadsec_last_seen": "2026-04-09T10:45:30.603Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "16735"
      ],
      "x_nadsec_orgs": [
        "ALGAR TELECOM SA"
      ]
    },
    {
      "created": "2026-04-01T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--2e28c6f0-d2f3-4479-b0dc-fa35edc80ab1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.202.4.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:05:10.000Z",
      "valid_until": "2026-05-03T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-01T19:01:49.786Z",
      "x_nadsec_last_seen": "2026-04-01T19:01:50.125Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-01T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--210433d7-83d1-4f33-af00-66b2da3511fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.129.187.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:05:10.000Z",
      "valid_until": "2026-05-03T19:05:09.000Z",
      "x_nadsec_event_count": 161,
      "x_nadsec_first_seen": "2026-04-01T19:01:22.173Z",
      "x_nadsec_last_seen": "2026-04-29T16:20:53.538Z",
      "x_nadsec_ports": [
        "445",
        "3306",
        "27017",
        "81",
        "1723",
        "1433",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "mysqld",
        "mongod",
        "httpd",
        "pptpd",
        "mssqld",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-01T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=pptpd; ports=1723; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--92ca091d-2fdb-49eb-abfa-3cab754ffb27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.132.26.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:05:10.000Z",
      "valid_until": "2026-05-03T19:05:09.000Z",
      "x_nadsec_event_count": 138,
      "x_nadsec_first_seen": "2026-04-01T18:25:43.229Z",
      "x_nadsec_last_seen": "2026-04-29T02:47:50.696Z",
      "x_nadsec_ports": [
        "1433",
        "81",
        "1723",
        "27017",
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "mssqld",
        "httpd",
        "pptpd",
        "mongod",
        "smbd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-01T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--4b82fd94-d160-4274-8198-de36134f7148",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.251.93.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:05:10.000Z",
      "valid_until": "2026-05-03T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T18:59:34.450Z",
      "x_nadsec_last_seen": "2026-04-01T18:59:34.450Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-01T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--e4be1f57-6a11-4a8e-b96c-2c437f6359c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '60.172.4.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:05:10.000Z",
      "valid_until": "2026-05-03T19:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-04-01T18:26:48.678Z",
      "x_nadsec_last_seen": "2026-04-12T17:00:03.242Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-01T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--740bd255-9e2e-491c-bac2-d757fe70bec0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:05:10.000Z",
      "valid_until": "2026-05-03T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-01T18:54:51.310Z",
      "x_nadsec_last_seen": "2026-04-19T06:33:26.399Z",
      "x_nadsec_ports": [
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-01T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--59085736-d867-43f6-bf97-0f1cf25a28af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '71.6.199.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:05:10.000Z",
      "valid_until": "2026-05-03T19:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-04-01T18:05:30.850Z",
      "x_nadsec_last_seen": "2026-04-28T14:41:49.798Z",
      "x_nadsec_ports": [
        "445",
        "27017",
        "21",
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mongod",
        "ftpd",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-04-01T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--e70ff5b8-c1de-4c78-b0bd-cfca48cf3564",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '8.209.83.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:05:10.000Z",
      "valid_until": "2026-05-03T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T18:08:47.456Z",
      "x_nadsec_last_seen": "2026-04-01T18:08:47.456Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-01T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--7b9a7694-3b51-4ec0-b3b3-e0b64fb2c200",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '81.215.211.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:05:10.000Z",
      "valid_until": "2026-05-03T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T19:01:54.097Z",
      "x_nadsec_last_seen": "2026-04-01T19:04:00.802Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-01T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--5fc697a2-cecb-4003-947c-9f76338adaa3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:05:10.000Z",
      "valid_until": "2026-05-03T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-01T18:09:39.945Z",
      "x_nadsec_last_seen": "2026-04-29T18:04:09.203Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-01T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--ce1fc6d2-88e3-4589-9c2f-ca16018dae9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:05:10.000Z",
      "valid_until": "2026-05-03T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T18:09:39.608Z",
      "x_nadsec_last_seen": "2026-04-01T18:09:39.608Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-01T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--e6a53644-490d-4e94-affd-c02072a4ff43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:05:10.000Z",
      "valid_until": "2026-05-03T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T18:09:15.688Z",
      "x_nadsec_last_seen": "2026-04-01T18:09:15.688Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-01T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--2360db1a-be83-40a2-b332-e01c42260786",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:05:10.000Z",
      "valid_until": "2026-05-03T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-01T18:09:15.894Z",
      "x_nadsec_last_seen": "2026-04-08T18:09:43.370Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-01T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=FR; asn=51167; asn_org=Contabo GmbH",
      "id": "indicator--2b3648d7-67f5-473a-89e3-3644017172f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '109.205.178.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T20:05:10.000Z",
      "valid_until": "2026-05-03T20:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-01T19:15:36.152Z",
      "x_nadsec_last_seen": "2026-04-01T19:15:37.121Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "51167"
      ],
      "x_nadsec_orgs": [
        "Contabo GmbH"
      ]
    },
    {
      "created": "2026-04-01T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VE; asn=264628; asn_org=CORPORACION FIBEX TELECOM, C.A.",
      "id": "indicator--85c4d0ab-1381-4235-bdcc-8d4f09586ff3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.120.252.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T20:05:10.000Z",
      "valid_until": "2026-05-03T20:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-01T19:44:52.401Z",
      "x_nadsec_last_seen": "2026-04-01T19:45:19.645Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "264628"
      ],
      "x_nadsec_orgs": [
        "CORPORACION FIBEX TELECOM, C.A."
      ]
    },
    {
      "created": "2026-04-01T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TN; asn=2609; asn_org=TN-BB-AS Tunisia BackBone AS",
      "id": "indicator--fea5da50-a595-4d29-9b3e-622a98b653fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '193.95.23.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T20:05:10.000Z",
      "valid_until": "2026-05-03T20:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T19:54:19.700Z",
      "x_nadsec_last_seen": "2026-04-01T19:54:19.700Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "2609"
      ],
      "x_nadsec_orgs": [
        "TN-BB-AS Tunisia BackBone AS"
      ]
    },
    {
      "created": "2026-04-01T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=20011; asn_org=NTT-DATA-Inc",
      "id": "indicator--4f72c373-fb9e-41b6-a704-093d0acc0fdd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.89.151.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T20:05:10.000Z",
      "valid_until": "2026-05-03T20:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T19:12:54.509Z",
      "x_nadsec_last_seen": "2026-04-01T19:15:02.208Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "20011"
      ],
      "x_nadsec_orgs": [
        "NTT-DATA-Inc"
      ]
    },
    {
      "created": "2026-04-01T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e569db8b-c847-4de8-8433-ed003a2201c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.14.90.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T20:05:10.000Z",
      "valid_until": "2026-05-03T20:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T19:21:22.259Z",
      "x_nadsec_last_seen": "2026-04-01T19:21:22.259Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-01T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--c05a083f-9807-4fe8-abd1-898440834dcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '201.103.142.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T20:05:10.000Z",
      "valid_until": "2026-05-03T20:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T19:59:02.861Z",
      "x_nadsec_last_seen": "2026-04-01T20:01:08.442Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-04-01T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mssqld; ports=1433; cc=VN; asn=38731; asn_org=CHT Compamy Ltd; user(top)=**",
      "id": "indicator--42d30a3b-b02c-436b-a749-748175d847d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '210.211.127.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T20:05:10.000Z",
      "valid_until": "2026-05-03T20:05:08.000Z",
      "x_nadsec_event_count": 55,
      "x_nadsec_first_seen": "2026-04-01T19:11:48.778Z",
      "x_nadsec_last_seen": "2026-04-25T13:34:22.010Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "38731"
      ],
      "x_nadsec_orgs": [
        "CHT Compamy Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-01T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=mongod; ports=27017; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--5ea5a271-9e38-4f11-993f-d7263f528e0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.134.216.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T20:05:10.000Z",
      "valid_until": "2026-05-03T20:05:08.000Z",
      "x_nadsec_event_count": 126,
      "x_nadsec_first_seen": "2026-04-01T19:43:23.827Z",
      "x_nadsec_last_seen": "2026-04-30T03:04:21.141Z",
      "x_nadsec_ports": [
        "27017",
        "445",
        "3306",
        "1433",
        "1723",
        "81"
      ],
      "x_nadsec_services": [
        "mongod",
        "smbd",
        "mysqld",
        "mssqld",
        "pptpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-01T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mssqld; ports=1433; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--6fe99a61-e033-4f1f-889c-b5250d94a28f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.74.51.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T20:05:10.000Z",
      "valid_until": "2026-05-03T20:05:08.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-01T19:17:13.989Z",
      "x_nadsec_last_seen": "2026-04-27T12:40:59.579Z",
      "x_nadsec_ports": [
        "1433",
        "27017"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mongod"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-01T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IE; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--a65559bc-017b-4418-a790-8a4f87c22142",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '54.76.173.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T20:05:10.000Z",
      "valid_until": "2026-05-03T20:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-01T19:11:19.102Z",
      "x_nadsec_last_seen": "2026-04-01T19:18:12.934Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IE"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-01T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--62927db6-1af5-48f4-ac83-97feade90ed8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T20:05:10.000Z",
      "valid_until": "2026-05-03T20:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-01T19:23:42.767Z",
      "x_nadsec_last_seen": "2026-04-30T03:34:55.566Z",
      "x_nadsec_ports": [
        "27017",
        "21"
      ],
      "x_nadsec_services": [
        "mongod",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-04-01T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--fb31bd08-44e0-4301-8fec-1c5363bb211f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.160.132.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T21:05:10.000Z",
      "valid_until": "2026-05-03T21:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-01T20:51:03.043Z",
      "x_nadsec_last_seen": "2026-04-01T20:53:06.974Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-01T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mssqld; ports=1433; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--cbae1715-03f1-4b03-9c28-42ca1b21b690",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.218.118.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T21:05:10.000Z",
      "valid_until": "2026-05-03T21:05:08.000Z",
      "x_nadsec_event_count": 170,
      "x_nadsec_first_seen": "2026-04-01T06:08:18.844Z",
      "x_nadsec_last_seen": "2026-04-30T16:49:06.577Z",
      "x_nadsec_ports": [
        "81",
        "27017",
        "1723",
        "3306",
        "1433",
        "445",
        "21"
      ],
      "x_nadsec_services": [
        "httpd",
        "mongod",
        "pptpd",
        "mysqld",
        "mssqld",
        "smbd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-01T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--bbbe4206-050e-470f-af0d-41b7d9303037",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.109.226.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T21:05:10.000Z",
      "valid_until": "2026-05-03T21:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T20:45:07.204Z",
      "x_nadsec_last_seen": "2026-04-01T20:47:13.359Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-04-01T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--d75debf7-57f1-43a2-9fd2-98addaed91cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T21:05:10.000Z",
      "valid_until": "2026-05-03T21:05:08.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-01T20:39:40.596Z",
      "x_nadsec_last_seen": "2026-04-08T19:40:43.985Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-04-01T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--7b39d916-7e15-455a-a5a4-688a66c1580e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '59.176.99.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T21:05:10.000Z",
      "valid_until": "2026-05-03T21:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T20:42:00.569Z",
      "x_nadsec_last_seen": "2026-04-01T20:42:00.569Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-04-01T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=401626; asn_org=Netiface America, Inc.",
      "id": "indicator--f8450206-7cc4-4008-81d7-91077407de2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T21:05:10.000Z",
      "valid_until": "2026-05-03T21:05:08.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-04-01T20:27:46.654Z",
      "x_nadsec_last_seen": "2026-04-29T22:59:27.652Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ]
    },
    {
      "created": "2026-04-01T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--65610f03-a81d-42b4-a28c-7238d7a6f0f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T21:05:10.000Z",
      "valid_until": "2026-05-03T21:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T20:57:23.747Z",
      "x_nadsec_last_seen": "2026-04-01T20:57:23.747Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-01T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--5ff5af9a-143c-45a0-81c9-858b85bd6fdd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T21:05:10.000Z",
      "valid_until": "2026-05-03T21:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-01T20:57:13.217Z",
      "x_nadsec_last_seen": "2026-04-01T20:57:13.217Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-02T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=139449; asn_org=PT Lintas Data Multimedia",
      "id": "indicator--f19ad781-49b8-40d2-8485-9fd22fca024a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.179.216.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T00:05:02.000Z",
      "valid_until": "2026-05-04T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T23:18:57.664Z",
      "x_nadsec_last_seen": "2026-04-01T23:21:03.082Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "139449"
      ],
      "x_nadsec_orgs": [
        "PT Lintas Data Multimedia"
      ]
    },
    {
      "created": "2026-04-02T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--db7a33f8-383a-48e5-8ecd-d39459e00d74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '122.160.3.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T00:05:02.000Z",
      "valid_until": "2026-05-04T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-01T23:08:02.256Z",
      "x_nadsec_last_seen": "2026-04-19T11:17:01.952Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-04-02T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=LK; asn=18001; asn_org=Dialog Axiata PLC.",
      "id": "indicator--2877e925-6055-4291-bf0c-641cf2a4c662",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '123.231.96.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T00:05:02.000Z",
      "valid_until": "2026-05-04T00:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-01T23:18:39.488Z",
      "x_nadsec_last_seen": "2026-04-01T23:25:16.650Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "18001"
      ],
      "x_nadsec_orgs": [
        "Dialog Axiata PLC."
      ]
    },
    {
      "created": "2026-04-02T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=262186; asn_org=TV AZTECA SUCURSAL COLOMBIA",
      "id": "indicator--badb3791-2e98-4cc7-bb90-660571f14baf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '177.93.43.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T00:05:02.000Z",
      "valid_until": "2026-05-04T00:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-01T23:49:00.978Z",
      "x_nadsec_last_seen": "2026-04-02T01:32:01.502Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "262186"
      ],
      "x_nadsec_orgs": [
        "TV AZTECA SUCURSAL COLOMBIA"
      ]
    },
    {
      "created": "2026-04-02T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=FR; asn=43350; asn_org=NForce Entertainment B.V.",
      "id": "indicator--5ee36acd-4492-4b81-af8f-a7b19bbef225",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.107.80.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T00:05:02.000Z",
      "valid_until": "2026-05-04T00:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-01T23:21:45.794Z",
      "x_nadsec_last_seen": "2026-04-29T22:39:25.890Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "43350"
      ],
      "x_nadsec_orgs": [
        "NForce Entertainment B.V."
      ]
    },
    {
      "created": "2026-04-02T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BH; asn=35568; asn_org=Nuetel Communications B.S.C",
      "id": "indicator--eb4f79ce-f2e8-4fd5-b438-4534cd1fa9c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.236.135.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T00:05:02.000Z",
      "valid_until": "2026-05-04T00:05:01.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-04-01T23:20:07.020Z",
      "x_nadsec_last_seen": "2026-04-27T16:57:35.801Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BH"
      ],
      "x_nadsec_asns": [
        "35568"
      ],
      "x_nadsec_orgs": [
        "Nuetel Communications B.S.C"
      ]
    },
    {
      "created": "2026-04-02T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--b7376888-7fc7-47a8-9e4f-32dd11f22eae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '58.56.135.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T00:05:02.000Z",
      "valid_until": "2026-05-04T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T00:03:12.948Z",
      "x_nadsec_last_seen": "2026-04-02T00:03:19.663Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-02T01:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e1f89d18-6544-4b81-9d41-62d4da42845a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T01:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '159.89.50.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T01:05:36.000Z",
      "valid_until": "2026-05-04T01:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T00:51:03.901Z",
      "x_nadsec_last_seen": "2026-04-02T15:27:44.525Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-02T01:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BR; asn=263661; asn_org=BRASIL DIGITAL SERVICOS DE INFORMATICA E COMERCIO",
      "id": "indicator--c6b2be29-7f76-4085-87fd-2a6c742efd36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T01:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '168.205.124.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T01:05:36.000Z",
      "valid_until": "2026-05-04T01:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-02T01:03:14.583Z",
      "x_nadsec_last_seen": "2026-04-02T01:10:23.566Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "263661"
      ],
      "x_nadsec_orgs": [
        "BRASIL DIGITAL SERVICOS DE INFORMATICA E COMERCIO"
      ]
    },
    {
      "created": "2026-04-02T01:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--e12b7f19-028a-488d-a00a-4f20600a4e67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T01:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T01:05:36.000Z",
      "valid_until": "2026-05-04T01:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T00:21:46.609Z",
      "x_nadsec_last_seen": "2026-04-02T00:22:16.610Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-02T01:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--0c66f612-c4f1-4a2c-a93e-b4afb67a376d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T01:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '54.224.210.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T01:05:36.000Z",
      "valid_until": "2026-05-04T01:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T00:54:43.800Z",
      "x_nadsec_last_seen": "2026-04-27T00:56:24.060Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-02T01:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=401626; asn_org=Netiface America, Inc.",
      "id": "indicator--f272a864-2c0c-444b-99f0-5aa65fb85e30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T01:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T01:05:36.000Z",
      "valid_until": "2026-05-04T01:05:10.000Z",
      "x_nadsec_event_count": 25,
      "x_nadsec_first_seen": "2026-04-02T00:05:24.270Z",
      "x_nadsec_last_seen": "2026-04-30T20:54:25.816Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ]
    },
    {
      "created": "2026-04-02T01:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=31; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b830c0c8-e8b0-4e54-a3b2-56343c869980",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T01:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.183.28.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T01:05:36.000Z",
      "valid_until": "2026-05-04T01:05:10.000Z",
      "x_nadsec_event_count": 31,
      "x_nadsec_first_seen": "2026-04-02T00:48:11.934Z",
      "x_nadsec_last_seen": "2026-04-02T00:51:00.432Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-02T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--d9177002-392c-4c7c-8311-e65f8cd356c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '183.252.22.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T02:05:10.000Z",
      "valid_until": "2026-05-04T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T01:31:34.391Z",
      "x_nadsec_last_seen": "2026-04-02T01:31:34.391Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-04-02T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=45804; asn_org=MEGHBELA BROADBAND",
      "id": "indicator--f9bb3408-fbf6-4d79-a449-23f4ecd2679d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '223.29.202.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T02:05:10.000Z",
      "valid_until": "2026-05-04T02:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-02T01:45:16.631Z",
      "x_nadsec_last_seen": "2026-04-02T01:51:46.838Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45804"
      ],
      "x_nadsec_orgs": [
        "MEGHBELA BROADBAND"
      ]
    },
    {
      "created": "2026-04-02T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--5e9026ac-323e-4325-8685-c5d88079c34f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.79.177.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T02:05:10.000Z",
      "valid_until": "2026-05-04T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T01:18:45.860Z",
      "x_nadsec_last_seen": "2026-04-28T10:46:03.926Z",
      "x_nadsec_ports": [
        "21",
        "445"
      ],
      "x_nadsec_services": [
        "ftpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-04-02T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2173; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--91ae114b-8ca1-4a7c-85b3-3bb9e1e0efc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.33.56.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T02:05:10.000Z",
      "valid_until": "2026-05-04T02:05:00.000Z",
      "x_nadsec_event_count": 11029,
      "x_nadsec_first_seen": "2026-04-02T01:29:45.482Z",
      "x_nadsec_last_seen": "2026-04-02T04:35:28.959Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-02T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--d85f8f93-648e-4f08-80e8-a653d16a567c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T02:05:10.000Z",
      "valid_until": "2026-05-04T02:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-02T01:31:05.260Z",
      "x_nadsec_last_seen": "2026-04-27T04:37:30.814Z",
      "x_nadsec_ports": [
        "27017",
        "135"
      ],
      "x_nadsec_services": [
        "mongod",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-02T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mongod; ports=27017; cc=RU; asn=9123; asn_org=Jsc timeweb",
      "id": "indicator--da279b55-d8fd-48a3-8313-c9f86cdaa466",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.239.52.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T02:05:10.000Z",
      "valid_until": "2026-05-04T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T01:50:20.541Z",
      "x_nadsec_last_seen": "2026-04-02T01:50:42.440Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "9123"
      ],
      "x_nadsec_orgs": [
        "Jsc timeweb"
      ]
    },
    {
      "created": "2026-04-02T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--9bd1871d-7259-4974-bef6-a2a76341b325",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '122.121.220.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:05:10.000Z",
      "valid_until": "2026-05-04T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T02:38:08.111Z",
      "x_nadsec_last_seen": "2026-04-02T02:40:13.554Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-02T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=NG; asn=328203; asn_org=Platinum-Index-AS",
      "id": "indicator--9446a48e-7e4c-45f5-b227-66e8e35f9d44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '156.0.249.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:05:10.000Z",
      "valid_until": "2026-05-04T03:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-02T02:40:47.979Z",
      "x_nadsec_last_seen": "2026-04-02T02:46:07.273Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "328203"
      ],
      "x_nadsec_orgs": [
        "Platinum-Index-AS"
      ]
    },
    {
      "created": "2026-04-02T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--fca223a5-a914-43a4-8213-f9996d859ff9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.100.93.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:05:10.000Z",
      "valid_until": "2026-05-04T03:05:09.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-04-02T02:38:12.676Z",
      "x_nadsec_last_seen": "2026-04-02T02:38:22.654Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "a*****3"
      ]
    },
    {
      "created": "2026-04-02T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--ee789d8c-e31d-4c39-b530-b7da74dd83b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '188.254.109.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:05:10.000Z",
      "valid_until": "2026-05-04T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T02:52:29.018Z",
      "x_nadsec_last_seen": "2026-04-02T02:54:35.984Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-02T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--1ef7a277-8d27-4441-8a26-d99ea9506f3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:05:10.000Z",
      "valid_until": "2026-05-04T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T02:42:44.308Z",
      "x_nadsec_last_seen": "2026-04-02T02:42:44.308Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-02T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--bd421caa-f48a-4e06-94a9-91e19015cef3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.221.56.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:05:10.000Z",
      "valid_until": "2026-05-04T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T02:53:41.012Z",
      "x_nadsec_last_seen": "2026-04-14T06:33:20.582Z",
      "x_nadsec_ports": [
        "21",
        "81"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-02T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=32098; asn_org=Transtelco Inc",
      "id": "indicator--4d2c0a9b-6cfb-4e44-82e1-880ca15ee12c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '201.161.46.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:05:10.000Z",
      "valid_until": "2026-05-04T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T02:06:24.858Z",
      "x_nadsec_last_seen": "2026-04-06T19:31:09.289Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "32098"
      ],
      "x_nadsec_orgs": [
        "Transtelco Inc"
      ]
    },
    {
      "created": "2026-04-02T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mssqld; ports=1433; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--e7504330-b5d6-4e44-9dd8-36caa7c5a215",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.131.220.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:05:10.000Z",
      "valid_until": "2026-05-04T03:05:09.000Z",
      "x_nadsec_event_count": 121,
      "x_nadsec_first_seen": "2026-04-01T21:11:28.187Z",
      "x_nadsec_last_seen": "2026-04-30T17:33:54.955Z",
      "x_nadsec_ports": [
        "3306",
        "1433",
        "1723",
        "445",
        "81",
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mssqld",
        "pptpd",
        "smbd",
        "httpd",
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-02T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--96a1cc5a-7934-4551-82e3-a4095699cdae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.76.107.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:05:10.000Z",
      "valid_until": "2026-05-04T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T03:01:36.241Z",
      "x_nadsec_last_seen": "2026-04-28T12:47:10.561Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-02T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=CH; asn=15169; asn_org=Google LLC",
      "id": "indicator--288e9699-7ee2-415f-aaf9-9b850e2ce191",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.216.201.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:05:10.000Z",
      "valid_until": "2026-05-04T03:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-02T02:19:17.129Z",
      "x_nadsec_last_seen": "2026-04-07T05:12:32.722Z",
      "x_nadsec_ports": [
        "3306",
        "445"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "15169"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-02T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SY; asn=29256; asn_org=Syrian Telecommunication Private Closed Joint Stock Company",
      "id": "indicator--707de3ae-33a3-4639-9313-ce120b6815c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '82.137.224.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:05:10.000Z",
      "valid_until": "2026-05-04T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T02:45:40.161Z",
      "x_nadsec_last_seen": "2026-04-02T02:47:47.286Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SY"
      ],
      "x_nadsec_asns": [
        "29256"
      ],
      "x_nadsec_orgs": [
        "Syrian Telecommunication Private Closed Joint Stock Company"
      ]
    },
    {
      "created": "2026-04-02T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d96b6e2d-6593-4863-a32b-4100845f89fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.119.96.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T04:05:12.000Z",
      "valid_until": "2026-05-04T04:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-02T03:12:33.490Z",
      "x_nadsec_last_seen": "2026-04-02T03:12:34.287Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-02T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=150452; asn_org=LANDUPS LIMITED",
      "id": "indicator--780c6de9-1122-4245-b2e9-e087c6ec5cee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '162.245.220.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T04:05:12.000Z",
      "valid_until": "2026-05-04T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T03:58:08.331Z",
      "x_nadsec_last_seen": "2026-04-02T04:00:12.772Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "150452"
      ],
      "x_nadsec_orgs": [
        "LANDUPS LIMITED"
      ]
    },
    {
      "created": "2026-04-02T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ZA; asn=37130; asn_org=SITA-AS",
      "id": "indicator--3b41e358-ba7e-4339-bb63-933db3f26417",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '164.151.136.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T04:05:12.000Z",
      "valid_until": "2026-05-04T04:05:09.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-04-02T03:54:53.667Z",
      "x_nadsec_last_seen": "2026-04-30T14:57:25.390Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "37130"
      ],
      "x_nadsec_orgs": [
        "SITA-AS"
      ]
    },
    {
      "created": "2026-04-02T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=203542; asn_org=It-prof LLC",
      "id": "indicator--4a026e31-1c9f-4060-8c0d-9cffb432c1a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.213.79.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T04:05:12.000Z",
      "valid_until": "2026-05-04T04:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-02T03:45:04.646Z",
      "x_nadsec_last_seen": "2026-04-02T03:45:48.194Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "203542"
      ],
      "x_nadsec_orgs": [
        "It-prof LLC"
      ]
    },
    {
      "created": "2026-04-02T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--dba10abf-5f3b-40f2-8203-2513b92f350f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '183.36.30.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T04:05:12.000Z",
      "valid_until": "2026-05-04T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T03:07:44.589Z",
      "x_nadsec_last_seen": "2026-04-02T03:07:51.308Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-02T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MX; asn=8151; asn_org=UNINET; user(top)=**",
      "id": "indicator--7c91e470-33d9-489a-bd4f-a7409086c8be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '187.211.126.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T04:05:12.000Z",
      "valid_until": "2026-05-04T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T03:56:28.329Z",
      "x_nadsec_last_seen": "2026-04-02T03:56:28.329Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-02T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6fbcbc62-d35a-4145-8298-8a84d6eae69c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T04:05:12.000Z",
      "valid_until": "2026-05-04T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T03:36:52.075Z",
      "x_nadsec_last_seen": "2026-04-02T03:36:52.075Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-02T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EC; asn=22724; asn_org=PUNTONET S.A.",
      "id": "indicator--44e81021-8a61-4676-bfeb-7ca414459420",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '200.105.245.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T04:05:12.000Z",
      "valid_until": "2026-05-04T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T03:29:02.513Z",
      "x_nadsec_last_seen": "2026-04-02T03:31:08.426Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "22724"
      ],
      "x_nadsec_orgs": [
        "PUNTONET S.A."
      ]
    },
    {
      "created": "2026-04-02T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MY; asn=9930; asn_org=TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al",
      "id": "indicator--47f82de9-c5bc-4478-9d52-6f6f22b791db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '210.19.68.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T04:05:12.000Z",
      "valid_until": "2026-05-04T04:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-02T03:24:03.773Z",
      "x_nadsec_last_seen": "2026-04-02T03:28:11.484Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "9930"
      ],
      "x_nadsec_orgs": [
        "TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al"
      ]
    },
    {
      "created": "2026-04-02T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**",
      "id": "indicator--513cc836-912c-41d4-a171-7fce9d9b0091",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '218.17.33.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T04:05:12.000Z",
      "valid_until": "2026-05-04T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T03:36:41.797Z",
      "x_nadsec_last_seen": "2026-04-02T03:36:41.797Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-02T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=56044; asn_org=China Mobile communications corporation",
      "id": "indicator--ca003151-c04b-497e-870d-79b14888dc1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '39.152.152.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T04:05:12.000Z",
      "valid_until": "2026-05-04T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T03:56:37.733Z",
      "x_nadsec_last_seen": "2026-04-02T03:58:42.939Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56044"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-04-02T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=RU; asn=214664; asn_org=JSC Buduschee",
      "id": "indicator--7bf855b2-2c0f-4087-9891-5b8464f4f553",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.91.64.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T04:05:12.000Z",
      "valid_until": "2026-05-04T04:05:09.000Z",
      "x_nadsec_event_count": 18,
      "x_nadsec_first_seen": "2026-04-02T03:11:45.787Z",
      "x_nadsec_last_seen": "2026-04-30T02:09:13.324Z",
      "x_nadsec_ports": [
        "3306",
        "27017",
        "21"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mongod",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "214664"
      ],
      "x_nadsec_orgs": [
        "JSC Buduschee"
      ]
    },
    {
      "created": "2026-04-02T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--93a04f41-0546-4637-b977-ed710917fcc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T04:05:12.000Z",
      "valid_until": "2026-05-04T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T03:06:35.044Z",
      "x_nadsec_last_seen": "2026-04-02T03:06:35.044Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-02T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--e5798e05-ef56-4660-837b-419c231d0d5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T04:05:12.000Z",
      "valid_until": "2026-05-04T04:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T03:06:34.796Z",
      "x_nadsec_last_seen": "2026-04-09T16:41:35.455Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-02T05:06:39.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PK; asn=45773; asn_org=PERN AS Content Servie Provider, Islamabad, Pakistan; user(top)=**",
      "id": "indicator--c62c3d45-6729-4a8b-8dc4-33f5f365ad35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T05:06:39.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '111.68.99.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T05:06:39.000Z",
      "valid_until": "2026-05-04T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T04:37:19.046Z",
      "x_nadsec_last_seen": "2026-04-14T20:51:41.176Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "45773"
      ],
      "x_nadsec_orgs": [
        "PERN AS Content Servie Provider, Islamabad, Pakistan"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-02T05:06:39.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--d577b099-401b-440f-bbc8-cdc3ce426d2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T05:06:39.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.202.7.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T05:06:39.000Z",
      "valid_until": "2026-05-04T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T04:47:00.543Z",
      "x_nadsec_last_seen": "2026-04-02T04:49:06.788Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-04-02T05:06:39.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--92ff04ab-3609-4760-9793-9da9a52fb2e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T05:06:39.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T05:06:39.000Z",
      "valid_until": "2026-05-04T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T04:10:42.278Z",
      "x_nadsec_last_seen": "2026-04-02T04:10:42.278Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-02T05:06:39.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--4d026314-70c3-4a18-8f6e-cd935a33f092",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T05:06:39.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.80.173.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T05:06:39.000Z",
      "valid_until": "2026-05-04T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T04:14:37.493Z",
      "x_nadsec_last_seen": "2026-04-02T04:16:42.505Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-02T05:06:39.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--239acffb-0653-4333-9d9f-86af7e0948fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T05:06:39.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.80.177.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T05:06:39.000Z",
      "valid_until": "2026-05-04T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T04:14:37.625Z",
      "x_nadsec_last_seen": "2026-04-02T04:16:41.401Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-02T05:06:39.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--e0ebcb8e-9b53-4eec-9cd7-e3b17c914919",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T05:06:39.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T05:06:39.000Z",
      "valid_until": "2026-05-04T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T04:32:55.905Z",
      "x_nadsec_last_seen": "2026-04-02T04:32:55.905Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-02T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--55414aea-b0dc-450f-a4c5-c8bafa270a3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '101.95.150.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T06:05:10.000Z",
      "valid_until": "2026-05-04T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T05:38:44.552Z",
      "x_nadsec_last_seen": "2026-04-02T05:38:44.552Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-04-02T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=138754; asn_org=Kerala Vision Broad Band Private Limited",
      "id": "indicator--80b18d38-7916-4b4f-8b2d-0e980544d5a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.139.64.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T06:05:10.000Z",
      "valid_until": "2026-05-04T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-02T05:38:20.026Z",
      "x_nadsec_last_seen": "2026-04-02T05:44:41.880Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "138754"
      ],
      "x_nadsec_orgs": [
        "Kerala Vision Broad Band Private Limited"
      ]
    },
    {
      "created": "2026-04-02T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--9c31a03e-8e26-47ec-ab68-b781e973033b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '109.105.209.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T06:05:10.000Z",
      "valid_until": "2026-05-04T06:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-02T05:32:25.226Z",
      "x_nadsec_last_seen": "2026-04-02T05:33:33.390Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-04-02T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--a873dbe0-a947-4010-9f36-5bc11592e8c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '109.105.209.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T06:05:10.000Z",
      "valid_until": "2026-05-04T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T05:32:41.461Z",
      "x_nadsec_last_seen": "2026-04-02T05:32:49.466Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-04-02T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--d3fc55d1-784b-47b9-9d74-24af12133dcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '109.105.209.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T06:05:10.000Z",
      "valid_until": "2026-05-04T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T05:33:02.633Z",
      "x_nadsec_last_seen": "2026-04-02T05:33:17.889Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-04-02T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--d21a451c-f2bb-48e4-90d7-c906652c7ad6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '109.105.209.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T06:05:10.000Z",
      "valid_until": "2026-05-04T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T05:32:31.847Z",
      "x_nadsec_last_seen": "2026-04-02T05:32:31.847Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-04-02T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MY; asn=4818; asn_org=DiGi Telecommunications Sdn. Bhd.",
      "id": "indicator--2f3b7a13-b697-4c52-915d-788ca7ecbd78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '115.164.119.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T06:05:10.000Z",
      "valid_until": "2026-05-04T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T05:53:21.098Z",
      "x_nadsec_last_seen": "2026-04-02T05:55:26.495Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "4818"
      ],
      "x_nadsec_orgs": [
        "DiGi Telecommunications Sdn. Bhd."
      ]
    },
    {
      "created": "2026-04-02T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=JP; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--fba797f0-8312-47ca-b6ad-0f566d6414a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '139.162.119.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T06:05:10.000Z",
      "valid_until": "2026-05-04T06:05:09.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-04-02T05:49:41.405Z",
      "x_nadsec_last_seen": "2026-04-30T11:58:07.590Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-02T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--fd9d18df-81f6-4018-9a5b-e119ae76ee99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.241.172.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T06:05:10.000Z",
      "valid_until": "2026-05-04T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T05:18:33.492Z",
      "x_nadsec_last_seen": "2026-04-02T05:18:33.535Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-02T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c803bcb5-9623-47d1-84e9-1606d7ab4c11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.203.245.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T06:05:10.000Z",
      "valid_until": "2026-05-04T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T05:31:37.653Z",
      "x_nadsec_last_seen": "2026-04-02T05:31:47.843Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-02T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--dcf8b7a8-c368-4a95-b2f0-f93ea583149d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.66.159.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T06:05:10.000Z",
      "valid_until": "2026-05-04T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-02T05:54:22.415Z",
      "x_nadsec_last_seen": "2026-04-02T06:02:18.472Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-02T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--8a0528da-1164-4619-8fed-cdaa320d5ef1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T06:05:10.000Z",
      "valid_until": "2026-05-04T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T05:53:07.398Z",
      "x_nadsec_last_seen": "2026-04-02T05:53:07.398Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-02T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--1eb37ccb-b9f1-4e10-bd96-a8870587dc50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.78.28.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T06:05:10.000Z",
      "valid_until": "2026-05-04T06:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-02T05:35:16.046Z",
      "x_nadsec_last_seen": "2026-04-30T04:51:57.461Z",
      "x_nadsec_ports": [
        "21",
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s",
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        "",
        "a********@"
      ]
    },
    {
      "created": "2026-04-02T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--87cc1600-360b-4577-be70-f0b4540cd504",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.63.111.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T06:05:10.000Z",
      "valid_until": "2026-05-04T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T05:35:24.458Z",
      "x_nadsec_last_seen": "2026-04-02T05:35:31.851Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-04-02T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PL; asn=12741; asn_org=Netia SA",
      "id": "indicator--26406a51-9c03-4993-890e-0a6ae256c54c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '62.233.166.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T06:05:10.000Z",
      "valid_until": "2026-05-04T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T05:16:57.023Z",
      "x_nadsec_last_seen": "2026-04-02T05:19:03.322Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "12741"
      ],
      "x_nadsec_orgs": [
        "Netia SA"
      ]
    },
    {
      "created": "2026-04-02T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e73c4ab7-ae70-499d-bba2-ef0e9fe42204",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.183.114.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T06:05:10.000Z",
      "valid_until": "2026-05-04T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T05:12:25.900Z",
      "x_nadsec_last_seen": "2026-04-02T05:12:25.900Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-02T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--a7a149d5-0fa1-4fef-ba9f-09a2c7a6c1a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '90.189.62.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T06:05:10.000Z",
      "valid_until": "2026-05-04T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T05:54:30.926Z",
      "x_nadsec_last_seen": "2026-04-02T05:54:31.003Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-02T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=KZ; asn=35104; asn_org=Jusan Mobile JSC",
      "id": "indicator--cc248ede-5682-4db8-8511-7d8d9ba2d4a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '95.141.131.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T06:05:10.000Z",
      "valid_until": "2026-05-04T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T05:59:31.846Z",
      "x_nadsec_last_seen": "2026-04-02T05:59:32.206Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "35104"
      ],
      "x_nadsec_orgs": [
        "Jusan Mobile JSC"
      ]
    },
    {
      "created": "2026-04-02T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=23674; asn_org=Nayatel Pvt Ltd",
      "id": "indicator--cff03fcb-b399-430e-908f-ec7b3b7d4087",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '101.50.75.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T07:05:11.000Z",
      "valid_until": "2026-05-04T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T06:37:01.632Z",
      "x_nadsec_last_seen": "2026-04-02T06:39:07.155Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23674"
      ],
      "x_nadsec_orgs": [
        "Nayatel Pvt Ltd"
      ]
    },
    {
      "created": "2026-04-02T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45609; asn_org=Bharti Airtel Ltd. AS for GPRS Service",
      "id": "indicator--f94c61fb-7bac-4c85-a98f-caf4f6a8d054",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '106.205.188.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T07:05:11.000Z",
      "valid_until": "2026-05-04T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T06:10:13.676Z",
      "x_nadsec_last_seen": "2026-04-02T06:12:19.678Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45609"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd. AS for GPRS Service"
      ]
    },
    {
      "created": "2026-04-02T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--c9098ecf-2bb4-42c5-a9d5-968cb58d261d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '109.169.206.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T07:05:11.000Z",
      "valid_until": "2026-05-04T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T06:38:04.904Z",
      "x_nadsec_last_seen": "2026-04-02T06:40:11.469Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-02T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=23674; asn_org=Nayatel Pvt Ltd",
      "id": "indicator--4e415361-c5ef-4846-9e13-b70dfdce3794",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '115.186.167.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T07:05:11.000Z",
      "valid_until": "2026-05-04T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T06:33:28.792Z",
      "x_nadsec_last_seen": "2026-04-02T06:35:34.361Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23674"
      ],
      "x_nadsec_orgs": [
        "Nayatel Pvt Ltd"
      ]
    },
    {
      "created": "2026-04-02T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--8e4c6cfb-fd4e-4f5c-8385-75231417140d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T07:05:11.000Z",
      "valid_until": "2026-05-04T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T06:06:36.131Z",
      "x_nadsec_last_seen": "2026-04-02T06:34:42.038Z",
      "x_nadsec_ports": [
        "445",
        "1723"
      ],
      "x_nadsec_services": [
        "smbd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-02T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--1d97ce7b-bc4f-4c63-9488-01d5b12b0147",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.176.87.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T07:05:11.000Z",
      "valid_until": "2026-05-04T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T06:58:38.564Z",
      "x_nadsec_last_seen": "2026-04-02T06:58:48.726Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-04-02T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--f588182d-d02b-42fc-a334-4446be7ecf75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.53.132.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T07:05:11.000Z",
      "valid_until": "2026-05-04T07:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-02T06:54:09.526Z",
      "x_nadsec_last_seen": "2026-04-02T06:56:16.000Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-02T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--d582ca9c-0afd-4f9a-a041-078135f0c5c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T07:05:11.000Z",
      "valid_until": "2026-05-04T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T06:58:25.764Z",
      "x_nadsec_last_seen": "2026-04-20T02:53:11.414Z",
      "x_nadsec_ports": [
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-02T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31430; asn_org=OOO Suntel",
      "id": "indicator--e59616e4-73bd-45dd-bd9d-e1b2203426b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '217.147.21.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T07:05:11.000Z",
      "valid_until": "2026-05-04T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T06:16:48.711Z",
      "x_nadsec_last_seen": "2026-04-02T06:18:55.392Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31430"
      ],
      "x_nadsec_orgs": [
        "OOO Suntel"
      ]
    },
    {
      "created": "2026-04-02T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--7fc6e8b0-fd36-4204-a8c1-67a83d80e114",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '223.206.224.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T07:05:11.000Z",
      "valid_until": "2026-05-04T07:05:09.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-04-02T06:41:41.215Z",
      "x_nadsec_last_seen": "2026-04-02T06:43:55.987Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-04-02T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IQ; asn=203214; asn_org=Hulum Almustakbal Company for Communication Engineering and Services Ltd",
      "id": "indicator--b391bd22-e433-4e9f-b575-99dbbde563d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.239.47.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T07:05:11.000Z",
      "valid_until": "2026-05-04T07:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-02T06:53:38.104Z",
      "x_nadsec_last_seen": "2026-04-04T04:24:10.608Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IQ"
      ],
      "x_nadsec_asns": [
        "203214"
      ],
      "x_nadsec_orgs": [
        "Hulum Almustakbal Company for Communication Engineering and Services Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-02T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--3089ff16-c361-4e16-bf22-60b583437de0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.38.141.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T07:05:11.000Z",
      "valid_until": "2026-05-04T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T06:54:09.844Z",
      "x_nadsec_last_seen": "2026-04-02T06:54:09.844Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-02T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IT; asn=30722; asn_org=Fastweb",
      "id": "indicator--8200ecd0-bc36-4fa4-8860-6e71a72a85b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.88.115.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T07:05:11.000Z",
      "valid_until": "2026-05-04T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T06:17:42.825Z",
      "x_nadsec_last_seen": "2026-04-02T06:17:42.825Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "30722"
      ],
      "x_nadsec_orgs": [
        "Fastweb"
      ]
    },
    {
      "created": "2026-04-02T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--db81c215-aa54-46a7-991f-e56e29be14b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T07:05:11.000Z",
      "valid_until": "2026-05-04T07:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-02T06:27:01.610Z",
      "x_nadsec_last_seen": "2026-04-30T14:02:19.197Z",
      "x_nadsec_ports": [
        "135",
        "21",
        "1723",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "mongod",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-04-02T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--c105fbe8-6e24-4257-a593-ff49691f5bc4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.4.186.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T08:05:10.000Z",
      "valid_until": "2026-05-04T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-02T07:50:55.866Z",
      "x_nadsec_last_seen": "2026-04-02T07:57:39.945Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-04-02T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=137143; asn_org=Minnal Digital Network Private Limited",
      "id": "indicator--e1b31de5-e9d0-4d8d-9741-4f175950d88c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.105.43.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T08:05:10.000Z",
      "valid_until": "2026-05-04T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T08:01:41.363Z",
      "x_nadsec_last_seen": "2026-04-02T08:03:45.935Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "137143"
      ],
      "x_nadsec_orgs": [
        "Minnal Digital Network Private Limited"
      ]
    },
    {
      "created": "2026-04-02T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--7af4defa-e5da-46fb-b3ee-5e202b3cf2f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '106.222.216.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T08:05:10.000Z",
      "valid_until": "2026-05-04T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-02T07:54:02.396Z",
      "x_nadsec_last_seen": "2026-04-02T07:59:08.370Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-04-02T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--941fdd3b-229e-4844-9cad-8a7999ce3529",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '110.77.191.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T08:05:10.000Z",
      "valid_until": "2026-05-04T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-02T07:49:01.606Z",
      "x_nadsec_last_seen": "2026-04-02T07:53:34.521Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-04-02T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--53f9a07b-dba2-4595-963a-22c1b8db0e24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T08:05:10.000Z",
      "valid_until": "2026-05-04T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T07:28:45.902Z",
      "x_nadsec_last_seen": "2026-04-29T15:46:56.569Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "1433",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd",
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-02T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--ad9c898a-2fa8-4847-9749-9f6dd1cad4df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '2.88.102.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T08:05:10.000Z",
      "valid_until": "2026-05-04T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T07:59:59.361Z",
      "x_nadsec_last_seen": "2026-04-02T07:59:59.390Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-04-02T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--1c8db237-cc6d-4c88-a068-f1382fa9faf1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T08:05:10.000Z",
      "valid_until": "2026-05-04T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T07:38:04.046Z",
      "x_nadsec_last_seen": "2026-04-02T07:38:04.046Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-02T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--09ecad27-90b7-4118-a8ed-4d2cce33c24f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '80.234.82.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T08:05:10.000Z",
      "valid_until": "2026-05-04T08:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-02T07:59:22.697Z",
      "x_nadsec_last_seen": "2026-04-13T09:27:11.972Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-02T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=48642; asn_org=Joint stock company For",
      "id": "indicator--05055fa6-32b5-452c-b531-ab76bcff14df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '82.112.53.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T08:05:10.000Z",
      "valid_until": "2026-05-04T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-02T08:03:35.567Z",
      "x_nadsec_last_seen": "2026-04-02T08:14:48.715Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48642"
      ],
      "x_nadsec_orgs": [
        "Joint stock company For"
      ]
    },
    {
      "created": "2026-04-02T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=3269; asn_org=TIM",
      "id": "indicator--89442728-e116-49b6-8fe3-926549456edb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.43.58.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T08:05:10.000Z",
      "valid_until": "2026-05-04T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T07:09:28.518Z",
      "x_nadsec_last_seen": "2026-04-02T07:11:34.666Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "3269"
      ],
      "x_nadsec_orgs": [
        "TIM"
      ]
    },
    {
      "created": "2026-04-02T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=137143; asn_org=Minnal Digital Network Private Limited",
      "id": "indicator--374ccfca-a845-4b18-9eb0-1e7cb8ad94e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.105.43.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:05:11.000Z",
      "valid_until": "2026-05-04T09:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-02T08:35:44.776Z",
      "x_nadsec_last_seen": "2026-04-02T08:39:53.064Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "137143"
      ],
      "x_nadsec_orgs": [
        "Minnal Digital Network Private Limited"
      ]
    },
    {
      "created": "2026-04-02T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--148a4632-51fa-407f-8b87-2a49cc577042",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.182.195.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:05:11.000Z",
      "valid_until": "2026-05-04T09:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T08:56:39.228Z",
      "x_nadsec_last_seen": "2026-04-02T08:58:43.476Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-04-02T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=138239; asn_org=Vaishnavi Online Internet Services Pvt. Ltd.",
      "id": "indicator--677429ab-94f6-49e6-8cf1-9a83d6f47757",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.65.203.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:05:11.000Z",
      "valid_until": "2026-05-04T09:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T08:06:01.717Z",
      "x_nadsec_last_seen": "2026-04-02T08:08:06.424Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "138239"
      ],
      "x_nadsec_orgs": [
        "Vaishnavi Online Internet Services Pvt. Ltd."
      ]
    },
    {
      "created": "2026-04-02T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--1951893d-25d6-4ebb-89af-637c4781093d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '106.203.243.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:05:11.000Z",
      "valid_until": "2026-05-04T09:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T08:45:21.699Z",
      "x_nadsec_last_seen": "2026-04-02T08:45:21.887Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-04-02T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=17488; asn_org=Hathway IP Over Cable Internet",
      "id": "indicator--a687c30b-99fa-4a8e-8964-360f4d2ecdfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '115.96.78.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:05:11.000Z",
      "valid_until": "2026-05-04T09:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T08:47:25.902Z",
      "x_nadsec_last_seen": "2026-04-02T08:47:25.902Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17488"
      ],
      "x_nadsec_orgs": [
        "Hathway IP Over Cable Internet"
      ]
    },
    {
      "created": "2026-04-02T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--9a786440-dd6b-4763-9dad-8fa274b96f08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.116.138.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:05:11.000Z",
      "valid_until": "2026-05-04T09:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T08:19:04.604Z",
      "x_nadsec_last_seen": "2026-04-02T08:21:06.767Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-02T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a91a4577-ace0-40a1-b511-f3037cee1c77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.198.146.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:05:11.000Z",
      "valid_until": "2026-05-04T09:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T08:41:50.881Z",
      "x_nadsec_last_seen": "2026-04-02T08:41:50.881Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-02T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=47165; asn_org=Omskie kabelnye seti Ltd.",
      "id": "indicator--ccab55e7-1943-4a4d-a220-a68304f3cf21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.74.68.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:05:11.000Z",
      "valid_until": "2026-05-04T09:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T08:35:09.692Z",
      "x_nadsec_last_seen": "2026-04-02T08:49:20.954Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "47165"
      ],
      "x_nadsec_orgs": [
        "Omskie kabelnye seti Ltd."
      ]
    },
    {
      "created": "2026-04-02T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--6b489307-ae45-4d8a-b085-de93b06e001e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.8.179.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:05:11.000Z",
      "valid_until": "2026-05-04T09:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T08:06:52.905Z",
      "x_nadsec_last_seen": "2026-04-02T08:08:57.966Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-04-02T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--9c35d4e5-91ba-4f60-ba9c-b999144e4297",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:05:11.000Z",
      "valid_until": "2026-05-04T09:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T08:05:16.148Z",
      "x_nadsec_last_seen": "2026-04-02T08:05:16.409Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-04-02T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--f1ec5304-3ec8-4bf8-acef-6df427d74888",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:05:11.000Z",
      "valid_until": "2026-05-04T09:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-02T08:23:58.667Z",
      "x_nadsec_last_seen": "2026-04-29T15:03:42.026Z",
      "x_nadsec_ports": [
        "135",
        "21",
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-02T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=GE; asn=44327; asn_org=Delta Comm LLC",
      "id": "indicator--d1e610b9-9123-40ae-a748-4404a69819f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '92.51.75.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:05:11.000Z",
      "valid_until": "2026-05-04T09:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-02T08:37:52.664Z",
      "x_nadsec_last_seen": "2026-04-02T08:46:07.037Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "44327"
      ],
      "x_nadsec_orgs": [
        "Delta Comm LLC"
      ]
    },
    {
      "created": "2026-04-02T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=48524; asn_org=INTERRA telecommunications group, Ltd.",
      "id": "indicator--db4c89bf-652f-4fe9-b1eb-684d4db79d66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.190.108.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:05:11.000Z",
      "valid_until": "2026-05-04T09:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T08:57:28.357Z",
      "x_nadsec_last_seen": "2026-04-02T08:59:35.302Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48524"
      ],
      "x_nadsec_orgs": [
        "INTERRA telecommunications group, Ltd."
      ]
    },
    {
      "created": "2026-04-02T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--30046831-f0ee-4aea-bcbd-ab665534bb07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.171.158.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:05:06.000Z",
      "valid_until": "2026-05-04T10:05:04.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-02T09:42:26.376Z",
      "x_nadsec_last_seen": "2026-04-02T10:20:18.982Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-02T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=55699; asn_org=PT. Cemerlang Multimedia",
      "id": "indicator--96ed20e9-41e0-4ced-b520-c6d2581c0cb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.147.9.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:05:06.000Z",
      "valid_until": "2026-05-04T10:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T09:36:01.343Z",
      "x_nadsec_last_seen": "2026-04-02T09:38:05.552Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "55699"
      ],
      "x_nadsec_orgs": [
        "PT. Cemerlang Multimedia"
      ]
    },
    {
      "created": "2026-04-02T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45117; asn_org=Ishans Network",
      "id": "indicator--53785ddf-b011-4d39-9d88-7da7963df6c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.36.123.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:05:06.000Z",
      "valid_until": "2026-05-04T10:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T09:14:52.718Z",
      "x_nadsec_last_seen": "2026-04-02T09:17:00.196Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45117"
      ],
      "x_nadsec_orgs": [
        "Ishans Network"
      ]
    },
    {
      "created": "2026-04-02T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--c334fb2b-bb9c-4633-86e5-3bdc2876ccd1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '115.78.9.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:05:06.000Z",
      "valid_until": "2026-05-04T10:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-02T09:30:14.760Z",
      "x_nadsec_last_seen": "2026-04-02T09:32:19.431Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-02T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--b6eaa1dd-0f4b-4d62-bdfc-6213730b79c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '115.78.9.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:05:06.000Z",
      "valid_until": "2026-05-04T10:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T09:30:14.911Z",
      "x_nadsec_last_seen": "2026-04-02T09:30:14.911Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-02T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--0c1e8635-9782-4d7c-ba2e-a454b184b63e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '122.165.243.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:05:06.000Z",
      "valid_until": "2026-05-04T10:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-02T09:56:18.155Z",
      "x_nadsec_last_seen": "2026-04-02T10:02:41.021Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-04-02T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--90865a5b-faef-487a-8a10-c011c035c511",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.237.127.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:05:06.000Z",
      "valid_until": "2026-05-04T10:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T09:15:45.229Z",
      "x_nadsec_last_seen": "2026-04-02T09:15:45.229Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-02T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--7279c7c4-ce52-43c3-b54a-7499e55e652c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.166.132.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:05:06.000Z",
      "valid_until": "2026-05-04T10:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T09:42:22.087Z",
      "x_nadsec_last_seen": "2026-04-02T09:44:26.908Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-02T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PE; asn=3132; asn_org=Red Cientifica Peruana; user(top)=**",
      "id": "indicator--c5bdec3f-6172-4274-acf9-3a007a2db1e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '161.132.56.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:05:06.000Z",
      "valid_until": "2026-05-04T10:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-02T09:42:59.170Z",
      "x_nadsec_last_seen": "2026-04-25T21:00:29.233Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "3132"
      ],
      "x_nadsec_orgs": [
        "Red Cientifica Peruana"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-02T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=BR; asn=27699; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--34f3e1d0-46fc-443c-ba4a-40e8b52feddc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '177.197.66.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:05:06.000Z",
      "valid_until": "2026-05-04T10:05:04.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-02T09:05:32.966Z",
      "x_nadsec_last_seen": "2026-04-02T09:22:41.599Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "27699"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-04-02T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--65df4e03-92f9-4e39-a2cb-7807d45497c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '183.82.33.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:05:06.000Z",
      "valid_until": "2026-05-04T10:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T09:27:45.736Z",
      "x_nadsec_last_seen": "2026-04-02T09:29:50.588Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-04-02T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=201127; asn_org=Fastfone s.r.l.",
      "id": "indicator--39f63664-41cd-40c4-98eb-58a3504f764a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.84.91.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:05:06.000Z",
      "valid_until": "2026-05-04T10:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T09:18:38.404Z",
      "x_nadsec_last_seen": "2026-04-02T09:20:45.175Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "201127"
      ],
      "x_nadsec_orgs": [
        "Fastfone s.r.l."
      ]
    },
    {
      "created": "2026-04-02T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=138423; asn_org=CMPak Limited",
      "id": "indicator--a39ee134-333a-44da-9a7f-17d1d3853cdd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '223.123.38.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:05:06.000Z",
      "valid_until": "2026-05-04T10:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T09:16:19.983Z",
      "x_nadsec_last_seen": "2026-04-02T09:16:20.314Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "138423"
      ],
      "x_nadsec_orgs": [
        "CMPak Limited"
      ]
    },
    {
      "created": "2026-04-02T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--cc0f9641-d1c4-4acf-8690-876185165e80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:05:06.000Z",
      "valid_until": "2026-05-04T10:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-02T09:53:36.649Z",
      "x_nadsec_last_seen": "2026-04-25T12:47:20.964Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd",
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-02T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--fd467b3a-2387-4f6c-8dc4-155e828a654a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:05:06.000Z",
      "valid_until": "2026-05-04T10:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-02T09:33:56.222Z",
      "x_nadsec_last_seen": "2026-04-21T04:40:26.777Z",
      "x_nadsec_ports": [
        "135",
        "1433"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-02T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=CA; asn=12989; asn_org=Black HOST Ltd",
      "id": "indicator--63ea2fe5-3504-4c42-91d1-bb2cfb1521fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '86.54.31.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:05:06.000Z",
      "valid_until": "2026-05-04T10:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-02T09:38:10.993Z",
      "x_nadsec_last_seen": "2026-04-19T11:56:20.271Z",
      "x_nadsec_ports": [
        "1433",
        "1883"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "12989"
      ],
      "x_nadsec_orgs": [
        "Black HOST Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-02T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA",
      "id": "indicator--9bff84d8-62fc-4ab0-937e-343cfa70aa24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.179.102.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:05:06.000Z",
      "valid_until": "2026-05-04T10:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T09:53:37.142Z",
      "x_nadsec_last_seen": "2026-04-02T09:55:43.424Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ]
    },
    {
      "created": "2026-04-02T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=23; services=smbd; ports=445; cc=DZ; asn=33779; asn_org=wataniya-telecom-as",
      "id": "indicator--5a7bd409-0241-4f5c-836a-b9bdcc22e76a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '105.235.132.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:05:05.000Z",
      "valid_until": "2026-05-04T11:05:04.000Z",
      "x_nadsec_event_count": 23,
      "x_nadsec_first_seen": "2026-04-02T10:38:11.714Z",
      "x_nadsec_last_seen": "2026-04-02T10:38:43.434Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "33779"
      ],
      "x_nadsec_orgs": [
        "wataniya-telecom-as"
      ]
    },
    {
      "created": "2026-04-02T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2735; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--01e5e134-de33-4e3d-9156-b799f9bd3df1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.191.236.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:05:05.000Z",
      "valid_until": "2026-05-04T11:05:04.000Z",
      "x_nadsec_event_count": 2735,
      "x_nadsec_first_seen": "2026-04-02T10:27:29.563Z",
      "x_nadsec_last_seen": "2026-04-02T10:56:27.203Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-02T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--2090e8b6-d770-4201-8631-5dd09abd8827",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.242.107.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:05:05.000Z",
      "valid_until": "2026-05-04T11:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T10:48:01.577Z",
      "x_nadsec_last_seen": "2026-04-02T10:50:07.913Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-04-02T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--741b96a9-c256-4eb6-bc10-7c7ac911e7d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '159.223.120.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:05:05.000Z",
      "valid_until": "2026-05-04T11:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T10:15:44.049Z",
      "x_nadsec_last_seen": "2026-04-02T10:15:55.330Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-02T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--4c2a4cf6-63be-4fd4-929f-1dbc1b09a4b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.211.18.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:05:05.000Z",
      "valid_until": "2026-05-04T11:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T10:06:11.311Z",
      "x_nadsec_last_seen": "2026-04-02T10:08:19.018Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-02T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=41330; asn_org=T2 Mobile LLC",
      "id": "indicator--20f237fe-068d-4260-bfa2-71bdfffb3dd7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.59.131.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:05:05.000Z",
      "valid_until": "2026-05-04T11:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T10:42:52.681Z",
      "x_nadsec_last_seen": "2026-04-02T10:42:52.681Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "41330"
      ],
      "x_nadsec_orgs": [
        "T2 Mobile LLC"
      ]
    },
    {
      "created": "2026-04-02T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=2561; asn_org=EUN",
      "id": "indicator--e9efad2d-90af-4d7b-b171-0050bbb69c7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '193.227.49.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:05:05.000Z",
      "valid_until": "2026-05-04T11:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T10:53:17.022Z",
      "x_nadsec_last_seen": "2026-04-02T10:55:28.550Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "2561"
      ],
      "x_nadsec_orgs": [
        "EUN"
      ]
    },
    {
      "created": "2026-04-02T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=37705; asn_org=TOPNET",
      "id": "indicator--55a6aefa-a124-4f4f-b456-b38450658a2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.3.6.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:05:05.000Z",
      "valid_until": "2026-05-04T11:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T10:50:29.208Z",
      "x_nadsec_last_seen": "2026-04-02T10:52:36.081Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37705"
      ],
      "x_nadsec_orgs": [
        "TOPNET"
      ]
    },
    {
      "created": "2026-04-02T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--cab4e501-e9c3-454d-96ce-254c2545f857",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.118.200.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:05:05.000Z",
      "valid_until": "2026-05-04T11:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T10:07:33.974Z",
      "x_nadsec_last_seen": "2026-04-02T10:07:44.178Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-02T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4ad24fb0-c143-47d1-9106-25188217aae8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:05:05.000Z",
      "valid_until": "2026-05-04T11:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T10:33:47.884Z",
      "x_nadsec_last_seen": "2026-04-02T10:33:58.203Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-02T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--33303d6b-fe49-4165-a0a0-2fb0c5a116d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.227.15.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:05:05.000Z",
      "valid_until": "2026-05-04T11:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T10:15:56.364Z",
      "x_nadsec_last_seen": "2026-04-02T15:27:44.437Z",
      "x_nadsec_ports": [
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-02T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--6a2f5078-26ae-4bd5-93f2-8ce8f89180b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:05:05.000Z",
      "valid_until": "2026-05-04T11:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T10:37:57.619Z",
      "x_nadsec_last_seen": "2026-04-02T10:37:58.160Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-02T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RO; asn=204428; asn_org=SS-Net",
      "id": "indicator--04a8387f-61ea-48d8-974f-b9dd09f40661",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:05:05.000Z",
      "valid_until": "2026-05-04T11:05:04.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-02T10:13:03.502Z",
      "x_nadsec_last_seen": "2026-04-02T13:47:52.851Z",
      "x_nadsec_ports": [
        "135",
        "445"
      ],
      "x_nadsec_services": [
        "epmapper",
        "smbd"
      ],
      "x_nadsec_countries": [
        "RO"
      ],
      "x_nadsec_asns": [
        "204428"
      ],
      "x_nadsec_orgs": [
        "SS-Net"
      ]
    },
    {
      "created": "2026-04-02T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=12735; asn_org=TurkNet Iletisim Hizmetleri A.S.",
      "id": "indicator--51bf24f8-03e2-4193-a46b-c58b98853961",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '95.70.171.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:05:05.000Z",
      "valid_until": "2026-05-04T11:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T10:49:54.250Z",
      "x_nadsec_last_seen": "2026-04-02T10:52:00.713Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "12735"
      ],
      "x_nadsec_orgs": [
        "TurkNet Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-04-02T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--b44af9f4-233c-41e3-b417-0ad1e81d2a6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.144.170.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T12:05:14.000Z",
      "valid_until": "2026-05-04T12:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T11:07:39.468Z",
      "x_nadsec_last_seen": "2026-04-02T11:09:45.706Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-04-02T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--237f3d25-1633-4a60-9fd1-b8908e50d43e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '122.172.81.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T12:05:14.000Z",
      "valid_until": "2026-05-04T12:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T11:40:25.517Z",
      "x_nadsec_last_seen": "2026-04-02T11:42:30.190Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-04-02T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS; user(top)=**",
      "id": "indicator--9ea72ef1-9d51-474d-b378-3e5447de4db4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.96.160.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T12:05:14.000Z",
      "valid_until": "2026-05-04T12:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-02T11:34:13.475Z",
      "x_nadsec_last_seen": "2026-04-13T07:57:12.433Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-02T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--9bbe0154-c2a4-4e15-9b32-37bc00c8ebf3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.211.16.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T12:05:14.000Z",
      "valid_until": "2026-05-04T12:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T11:17:03.329Z",
      "x_nadsec_last_seen": "2026-04-02T11:19:10.896Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-02T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BO; asn=26210; asn_org=AXS Bolivia S. A.",
      "id": "indicator--d3880c36-f8d3-4590-a2a3-fd2f182caaa0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.121.234.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T12:05:14.000Z",
      "valid_until": "2026-05-04T12:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-02T11:21:39.009Z",
      "x_nadsec_last_seen": "2026-04-02T11:29:46.013Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "26210"
      ],
      "x_nadsec_orgs": [
        "AXS Bolivia S. A."
      ]
    },
    {
      "created": "2026-04-02T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--215f213d-c94c-4182-8c7e-35eac150dbfa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.150.193.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T12:05:14.000Z",
      "valid_until": "2026-05-04T12:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T11:45:19.921Z",
      "x_nadsec_last_seen": "2026-04-02T11:45:19.921Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-02T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--95ad3ab5-7bfe-4e5b-bdd4-b09c7fa7cef1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T12:05:14.000Z",
      "valid_until": "2026-05-04T12:05:12.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-04-02T11:26:36.328Z",
      "x_nadsec_last_seen": "2026-04-18T08:57:42.871Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "445",
        "1723",
        "3306",
        "1433",
        "1883"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd",
        "mysqld",
        "pptpd",
        "smbd",
        "mqttd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-04-02T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--b19f4d32-0750-4a4c-ad80-39d6ceaa8c70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.39.224.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T12:05:14.000Z",
      "valid_until": "2026-05-04T12:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T11:43:24.228Z",
      "x_nadsec_last_seen": "2026-04-02T11:45:31.297Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-02T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--c674b8f4-2f13-4440-9862-7bec575b792c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T12:05:14.000Z",
      "valid_until": "2026-05-04T12:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T11:22:18.335Z",
      "x_nadsec_last_seen": "2026-04-02T11:22:18.335Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-02T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=28890; asn_org=INSYS LLC",
      "id": "indicator--7aa68958-3c95-48f0-a126-e005369c8d91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.12.196.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T12:05:14.000Z",
      "valid_until": "2026-05-04T12:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-02T11:34:27.298Z",
      "x_nadsec_last_seen": "2026-04-06T02:28:49.938Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "28890"
      ],
      "x_nadsec_orgs": [
        "INSYS LLC"
      ]
    },
    {
      "created": "2026-04-02T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--5d63baf6-d141-491d-9942-a620bd16b959",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.161.104.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T13:05:05.000Z",
      "valid_until": "2026-05-04T13:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T13:00:09.510Z",
      "x_nadsec_last_seen": "2026-04-02T13:00:09.662Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-02T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=7602; asn_org=Sai gon Postel Corporation",
      "id": "indicator--aac4009d-5844-402d-ab45-b7f9e5b08497",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '116.118.119.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T13:05:05.000Z",
      "valid_until": "2026-05-04T13:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T13:00:47.075Z",
      "x_nadsec_last_seen": "2026-04-02T13:00:47.075Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7602"
      ],
      "x_nadsec_orgs": [
        "Sai gon Postel Corporation"
      ]
    },
    {
      "created": "2026-04-02T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=249; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--210b125e-b273-4dac-a1e8-fa3bbfc07da3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '116.98.3.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T13:05:05.000Z",
      "valid_until": "2026-05-04T13:05:04.000Z",
      "x_nadsec_event_count": 411,
      "x_nadsec_first_seen": "2026-04-02T13:02:07.046Z",
      "x_nadsec_last_seen": "2026-04-02T13:18:03.465Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-02T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--d1a42cae-6085-4cff-9424-8484d3df771b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '117.193.76.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T13:05:05.000Z",
      "valid_until": "2026-05-04T13:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-02T12:56:01.586Z",
      "x_nadsec_last_seen": "2026-04-02T12:56:26.826Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-04-02T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e097662c-92d2-4145-85ed-e92f095ec80d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '167.172.157.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T13:05:05.000Z",
      "valid_until": "2026-05-04T13:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T12:26:24.455Z",
      "x_nadsec_last_seen": "2026-04-02T12:26:27.676Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-02T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--f624f21d-fc34-485c-ac0f-d290b2b71d4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '187.220.38.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T13:05:05.000Z",
      "valid_until": "2026-05-04T13:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T12:05:44.184Z",
      "x_nadsec_last_seen": "2026-04-02T12:07:49.496Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-04-02T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--7c7abf33-9d98-458c-85c3-2f0c326afcd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T13:05:05.000Z",
      "valid_until": "2026-05-04T13:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T13:02:31.262Z",
      "x_nadsec_last_seen": "2026-04-02T13:02:31.262Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-02T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--d58c2416-3a3b-4ae0-861d-91b6a08d327e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.239.76.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T13:05:05.000Z",
      "valid_until": "2026-05-04T13:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T12:11:55.986Z",
      "x_nadsec_last_seen": "2026-04-02T12:14:01.464Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-02T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--5c58ee28-0d35-4a43-a1ce-6ea19f6d1fef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.106.63.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T13:05:05.000Z",
      "valid_until": "2026-05-04T13:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T12:38:35.475Z",
      "x_nadsec_last_seen": "2026-04-02T12:40:41.877Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-04-02T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--a366b5c8-28b0-4467-aabf-98f57f99f01e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.240.205.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T13:05:05.000Z",
      "valid_until": "2026-05-04T13:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T12:22:18.543Z",
      "x_nadsec_last_seen": "2026-04-25T08:27:45.865Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-04-02T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=146943; asn_org=Tier 4 Cloud Services",
      "id": "indicator--581fee53-0e54-4025-a489-bbbeea5216e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.233.24.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T14:05:11.000Z",
      "valid_until": "2026-05-04T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T13:27:04.257Z",
      "x_nadsec_last_seen": "2026-04-04T02:19:49.172Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "146943"
      ],
      "x_nadsec_orgs": [
        "Tier 4 Cloud Services"
      ]
    },
    {
      "created": "2026-04-02T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--54be3e1b-53d0-43bf-90fb-71a112ae6958",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.160.186.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T14:05:11.000Z",
      "valid_until": "2026-05-04T14:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-02T13:05:23.372Z",
      "x_nadsec_last_seen": "2026-04-06T09:09:09.653Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-02T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--3acc9ec9-ea82-449c-b318-c97a5ee7ac4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.178.227.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T14:05:11.000Z",
      "valid_until": "2026-05-04T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T13:44:00.137Z",
      "x_nadsec_last_seen": "2026-04-02T13:46:06.443Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-02T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=28343; asn_org=UNIFIQUE TELECOMUNICACOES SA",
      "id": "indicator--6ec9b8a6-8aa0-40bd-898c-413bbb2ba40b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '177.10.108.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T14:05:11.000Z",
      "valid_until": "2026-05-04T14:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T13:49:55.368Z",
      "x_nadsec_last_seen": "2026-04-02T13:49:55.501Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28343"
      ],
      "x_nadsec_orgs": [
        "UNIFIQUE TELECOMUNICACOES SA"
      ]
    },
    {
      "created": "2026-04-02T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=CO; asn=3816; asn_org=COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "id": "indicator--e73dbb0c-a027-4bcc-9e85-aa1640529afa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.116.1.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T14:05:11.000Z",
      "valid_until": "2026-05-04T14:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T13:48:33.280Z",
      "x_nadsec_last_seen": "2026-04-02T13:48:34.609Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "3816"
      ],
      "x_nadsec_orgs": [
        "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-02T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--5d9f34a8-c784-489d-9695-7de1b4f02102",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T14:05:11.000Z",
      "valid_until": "2026-05-04T14:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T13:45:14.998Z",
      "x_nadsec_last_seen": "2026-04-16T12:21:31.786Z",
      "x_nadsec_ports": [
        "1723",
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-02T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--c3644ed9-3b81-4177-b57d-550a58eb3e17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T14:05:11.000Z",
      "valid_until": "2026-05-04T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T13:31:40.184Z",
      "x_nadsec_last_seen": "2026-04-30T12:41:00.082Z",
      "x_nadsec_ports": [
        "27017",
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "mongod",
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-02T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=MN; asn=17882; asn_org=UNIVISION LLC",
      "id": "indicator--bfdbfe97-220b-4ff6-9a5c-0e4389746de7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.181.166.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T14:05:11.000Z",
      "valid_until": "2026-05-04T14:05:09.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-04-02T13:18:44.663Z",
      "x_nadsec_last_seen": "2026-04-30T20:24:59.685Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "17882"
      ],
      "x_nadsec_orgs": [
        "UNIVISION LLC"
      ]
    },
    {
      "created": "2026-04-02T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=ZW; asn=14593; asn_org=Space Exploration Technologies Corporation; user(top)=**",
      "id": "indicator--96e9d31b-1163-49ba-8f5e-d1d1ebcf44c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.244.195.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T14:05:11.000Z",
      "valid_until": "2026-05-04T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T14:01:41.658Z",
      "x_nadsec_last_seen": "2026-04-02T14:01:41.658Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "ZW"
      ],
      "x_nadsec_asns": [
        "14593"
      ],
      "x_nadsec_orgs": [
        "Space Exploration Technologies Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-02T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--9758775f-0df4-424b-b038-26bfc6b9a5ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T15:05:10.000Z",
      "valid_until": "2026-05-04T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T14:46:59.499Z",
      "x_nadsec_last_seen": "2026-04-02T14:46:59.499Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-02T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--9e6ce2f4-e047-422b-a0a3-4315e4c07aca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.210.53.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T15:05:10.000Z",
      "valid_until": "2026-05-04T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T14:27:36.754Z",
      "x_nadsec_last_seen": "2026-04-02T14:29:44.426Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-04-02T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--71aef8de-ea9f-4cf7-97b7-61490543797c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T15:05:10.000Z",
      "valid_until": "2026-05-04T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T15:04:45.563Z",
      "x_nadsec_last_seen": "2026-04-02T15:04:45.881Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-02T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--7ee49255-dd72-4d64-9ca0-81b255a99fe9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T15:05:10.000Z",
      "valid_until": "2026-05-04T15:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-02T14:07:26.172Z",
      "x_nadsec_last_seen": "2026-04-24T05:39:47.367Z",
      "x_nadsec_ports": [
        "445",
        "1723",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "mongod",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-02T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=48676; asn_org=LLC Svyazenergo",
      "id": "indicator--23edc2dc-8341-4760-8619-0b35d52c4c14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.211.181.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T15:05:10.000Z",
      "valid_until": "2026-05-04T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T14:59:31.275Z",
      "x_nadsec_last_seen": "2026-04-02T15:01:37.902Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48676"
      ],
      "x_nadsec_orgs": [
        "LLC Svyazenergo"
      ]
    },
    {
      "created": "2026-04-02T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=24955; asn_org=JSC Ufanet",
      "id": "indicator--635df4c3-0652-4384-8de0-1a142a5c9f0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '145.255.25.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T16:05:05.000Z",
      "valid_until": "2026-05-04T16:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T15:52:48.677Z",
      "x_nadsec_last_seen": "2026-04-02T15:54:55.273Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "24955"
      ],
      "x_nadsec_orgs": [
        "JSC Ufanet"
      ]
    },
    {
      "created": "2026-04-02T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=JM; asn=40786; asn_org=Digicel Jamaica",
      "id": "indicator--1522fe6b-1b0d-4c91-b5a8-a0e10506262f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '170.62.196.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T16:05:05.000Z",
      "valid_until": "2026-05-04T16:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-02T15:22:47.938Z",
      "x_nadsec_last_seen": "2026-04-02T15:22:51.828Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JM"
      ],
      "x_nadsec_asns": [
        "40786"
      ],
      "x_nadsec_orgs": [
        "Digicel Jamaica"
      ]
    },
    {
      "created": "2026-04-02T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=HU; asn=21334; asn_org=One Hungary Ltd.",
      "id": "indicator--70aeb7cb-95b9-4d61-b418-21c01bb2076f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.63.17.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T16:05:05.000Z",
      "valid_until": "2026-05-04T16:05:03.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-02T15:14:52.963Z",
      "x_nadsec_last_seen": "2026-04-28T14:03:40.294Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HU"
      ],
      "x_nadsec_asns": [
        "21334"
      ],
      "x_nadsec_orgs": [
        "One Hungary Ltd."
      ]
    },
    {
      "created": "2026-04-02T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f0062450-8d01-4199-8eb7-74149f2947c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T16:05:05.000Z",
      "valid_until": "2026-05-04T16:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T15:47:11.808Z",
      "x_nadsec_last_seen": "2026-04-02T15:47:12.448Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-02T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=8167; asn_org=V tal",
      "id": "indicator--8f2a0275-ef02-469e-93bf-404feba09a91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '201.88.0.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T16:05:05.000Z",
      "valid_until": "2026-05-04T16:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-02T15:56:29.544Z",
      "x_nadsec_last_seen": "2026-04-02T15:57:21.921Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "8167"
      ],
      "x_nadsec_orgs": [
        "V tal"
      ]
    },
    {
      "created": "2026-04-02T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--dbce38f0-6cb0-4311-8e7e-7f55b524e8fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T16:05:05.000Z",
      "valid_until": "2026-05-04T16:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T15:24:56.877Z",
      "x_nadsec_last_seen": "2026-04-02T15:24:56.877Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-02T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--c9dec768-54fe-4627-828d-785930ef029a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T16:05:05.000Z",
      "valid_until": "2026-05-04T16:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T15:16:08.433Z",
      "x_nadsec_last_seen": "2026-04-24T07:01:37.560Z",
      "x_nadsec_ports": [
        "21",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-02T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GA; asn=16058; asn_org=Gabon-Telecom",
      "id": "indicator--25c2e7e7-40ee-431d-9ac4-fb8c0ccf2a78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.159.133.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T16:05:05.000Z",
      "valid_until": "2026-05-04T16:05:03.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-04-02T15:46:59.103Z",
      "x_nadsec_last_seen": "2026-04-15T08:33:00.912Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GA"
      ],
      "x_nadsec_asns": [
        "16058"
      ],
      "x_nadsec_orgs": [
        "Gabon-Telecom"
      ]
    },
    {
      "created": "2026-04-02T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=269814; asn_org=PROLUX COMSER S.A.",
      "id": "indicator--ad54f6eb-704a-40e3-9ea4-623686b2e675",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.186.25.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T16:05:05.000Z",
      "valid_until": "2026-05-04T16:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T15:09:31.397Z",
      "x_nadsec_last_seen": "2026-04-02T15:11:38.176Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "269814"
      ],
      "x_nadsec_orgs": [
        "PROLUX COMSER S.A."
      ]
    },
    {
      "created": "2026-04-02T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=268321; asn_org=SM Passos Kayser Sistemas de Comunicacoes ME",
      "id": "indicator--cead9340-e8eb-47d5-bd9b-47fa9bc81fa1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.238.64.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T16:05:05.000Z",
      "valid_until": "2026-05-04T16:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T16:01:03.504Z",
      "x_nadsec_last_seen": "2026-04-02T16:01:03.822Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "268321"
      ],
      "x_nadsec_orgs": [
        "SM Passos Kayser Sistemas de Comunicacoes ME"
      ]
    },
    {
      "created": "2026-04-02T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--7280e47c-cde8-4282-9d73-d1cc2b719f41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '52.188.189.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T16:05:05.000Z",
      "valid_until": "2026-05-04T16:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T15:56:59.307Z",
      "x_nadsec_last_seen": "2026-04-02T15:56:59.709Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-02T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6c16dec4-5482-4b3d-ba72-4374ea4475b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.183.22.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T16:05:05.000Z",
      "valid_until": "2026-05-04T16:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T15:27:43.450Z",
      "x_nadsec_last_seen": "2026-04-02T15:27:43.450Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-02T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PE; asn=27843; asn_org=WIN EMPRESAS S.A.C.",
      "id": "indicator--77921432-6466-4e02-904e-fd12548ce0b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '170.0.233.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T17:05:11.000Z",
      "valid_until": "2026-05-04T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-02T16:56:22.751Z",
      "x_nadsec_last_seen": "2026-04-02T17:03:16.179Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "27843"
      ],
      "x_nadsec_orgs": [
        "WIN EMPRESAS S.A.C."
      ]
    },
    {
      "created": "2026-04-02T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--0a3ae167-0f11-4a71-b248-622c57c94a38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '181.115.171.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T17:05:11.000Z",
      "valid_until": "2026-05-04T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T16:55:35.309Z",
      "x_nadsec_last_seen": "2026-04-02T16:57:41.469Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-04-02T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=27699; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--e3afdc69-7fc5-480a-9d84-9d9df46b2877",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '187.11.73.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T17:05:11.000Z",
      "valid_until": "2026-05-04T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-02T16:57:26.384Z",
      "x_nadsec_last_seen": "2026-04-02T17:02:02.127Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "27699"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-04-02T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--cc910ec7-2a6b-4b05-ae96-c52aad4550af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '188.18.53.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T17:05:11.000Z",
      "valid_until": "2026-05-04T17:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-02T16:56:56.619Z",
      "x_nadsec_last_seen": "2026-04-02T17:55:42.604Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-02T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--eb9a35a4-209d-4688-bc03-92105c073af5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T17:05:11.000Z",
      "valid_until": "2026-05-04T17:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-02T16:54:52.663Z",
      "x_nadsec_last_seen": "2026-04-30T04:53:40.885Z",
      "x_nadsec_ports": [
        "445",
        "3306",
        "81",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mysqld",
        "httpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-02T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--8d6218e5-814d-4bad-b6a5-f6b8d178475c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.52.219.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T17:05:11.000Z",
      "valid_until": "2026-05-04T17:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T16:52:59.928Z",
      "x_nadsec_last_seen": "2026-04-17T16:43:27.027Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-02T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--03f04453-f7bf-49ba-9ff5-d387f359dc38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.79.235.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T17:05:11.000Z",
      "valid_until": "2026-05-04T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T16:52:59.365Z",
      "x_nadsec_last_seen": "2026-04-02T16:52:59.365Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-02T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=CH; asn=15169; asn_org=Google LLC",
      "id": "indicator--1da06069-e4e2-49eb-8076-a53f406bccb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.216.254.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T17:05:11.000Z",
      "valid_until": "2026-05-04T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T16:28:38.927Z",
      "x_nadsec_last_seen": "2026-04-02T16:28:45.169Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "15169"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-02T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--f66e3b9b-6151-49ac-a278-2accd9e2af89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T17:05:11.000Z",
      "valid_until": "2026-05-04T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T16:33:10.233Z",
      "x_nadsec_last_seen": "2026-04-02T16:33:10.233Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-02T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--22ed2c9d-1360-4001-9164-6a7e5e1b327a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '78.180.236.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T17:05:11.000Z",
      "valid_until": "2026-05-04T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T16:21:23.018Z",
      "x_nadsec_last_seen": "2026-04-02T16:23:29.630Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-02T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--390ea71b-063a-4ebb-b53b-99b8970a6b72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T17:05:11.000Z",
      "valid_until": "2026-05-04T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T16:48:00.203Z",
      "x_nadsec_last_seen": "2026-04-02T16:48:00.203Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-02T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3bdb222b-d635-41b5-9b3a-a60e00532a57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T17:05:11.000Z",
      "valid_until": "2026-05-04T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T16:47:49.612Z",
      "x_nadsec_last_seen": "2026-04-02T16:47:49.612Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-02T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=60246; asn_org=Consumer Internet Cooperative PG-19",
      "id": "indicator--e0835a71-a575-4f39-af2f-808ef78e3cad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '95.174.98.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T17:05:11.000Z",
      "valid_until": "2026-05-04T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T16:53:31.318Z",
      "x_nadsec_last_seen": "2026-04-02T16:55:37.593Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "60246"
      ],
      "x_nadsec_orgs": [
        "Consumer Internet Cooperative PG-19"
      ]
    },
    {
      "created": "2026-04-02T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--448df429-7a8b-421a-8d64-202af5afd12f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.130.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T19:05:10.000Z",
      "valid_until": "2026-05-04T19:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-02T18:53:52.084Z",
      "x_nadsec_last_seen": "2026-04-15T19:13:15.396Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-02T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--26a250ec-aa8f-4775-854d-20d0b3716056",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '180.103.117.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T19:05:10.000Z",
      "valid_until": "2026-05-04T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T18:12:46.168Z",
      "x_nadsec_last_seen": "2026-04-13T22:33:40.877Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-02T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=50219; asn_org=Valence Technology Co.",
      "id": "indicator--f862750a-1364-4ac3-8d4a-d0cb0fca9f7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.164.107.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T19:05:10.000Z",
      "valid_until": "2026-05-04T19:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-02T17:31:42.741Z",
      "x_nadsec_last_seen": "2026-04-27T21:33:46.710Z",
      "x_nadsec_ports": [
        "445",
        "135"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "50219"
      ],
      "x_nadsec_orgs": [
        "Valence Technology Co."
      ]
    },
    {
      "created": "2026-04-02T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom; user(top)=**",
      "id": "indicator--40ab60d6-1f51-4a31-b774-ec099d8580b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.82.13.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T19:05:10.000Z",
      "valid_until": "2026-05-04T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T18:31:40.064Z",
      "x_nadsec_last_seen": "2026-04-02T18:31:40.064Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-02T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=52963; asn_org=JATIMNET TELECOM; user(top)=**",
      "id": "indicator--ee1f114d-c564-46d5-8161-c8ccec60d8d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '201.150.24.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T19:05:10.000Z",
      "valid_until": "2026-05-04T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T18:42:40.680Z",
      "x_nadsec_last_seen": "2026-04-02T18:42:40.680Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52963"
      ],
      "x_nadsec_orgs": [
        "JATIMNET TELECOM"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-02T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=mongod; ports=27017; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--8be5d4f2-2465-4a2f-9c98-ca73bc20b517",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.130.168.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T19:05:10.000Z",
      "valid_until": "2026-05-04T19:05:09.000Z",
      "x_nadsec_event_count": 119,
      "x_nadsec_first_seen": "2026-04-02T18:27:05.854Z",
      "x_nadsec_last_seen": "2026-04-29T19:50:41.628Z",
      "x_nadsec_ports": [
        "81",
        "445",
        "3306",
        "27017",
        "1723",
        "1433",
        "21"
      ],
      "x_nadsec_services": [
        "httpd",
        "smbd",
        "mysqld",
        "mongod",
        "pptpd",
        "mssqld",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-02T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--211ddca1-2e1d-4e0c-9764-b6231e5fe5f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.32.217.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T19:05:10.000Z",
      "valid_until": "2026-05-04T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T18:09:59.598Z",
      "x_nadsec_last_seen": "2026-04-12T05:51:54.777Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-02T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--3da8ebb0-1b1c-475b-a9e7-77989258a8cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.195.87.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T19:05:10.000Z",
      "valid_until": "2026-05-04T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T18:50:30.878Z",
      "x_nadsec_last_seen": "2026-04-02T18:50:35.859Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ]
    },
    {
      "created": "2026-04-02T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--b9588c94-25ca-4a34-8946-ecf74dc7bdba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T19:05:10.000Z",
      "valid_until": "2026-05-04T19:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-02T18:38:31.850Z",
      "x_nadsec_last_seen": "2026-04-27T10:32:26.743Z",
      "x_nadsec_ports": [
        "81",
        "1883"
      ],
      "x_nadsec_services": [
        "httpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-02T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=FR; asn=16347; asn_org=ADISTA SAS",
      "id": "indicator--58049f56-30c8-4afa-ab5c-128f67584392",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.98.102.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T19:05:10.000Z",
      "valid_until": "2026-05-04T19:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-02T18:46:41.003Z",
      "x_nadsec_last_seen": "2026-04-06T01:24:08.017Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16347"
      ],
      "x_nadsec_orgs": [
        "ADISTA SAS"
      ]
    },
    {
      "created": "2026-04-02T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=134008; asn_org=T10 Networks",
      "id": "indicator--3db6ac52-6c4f-4e65-b847-d648d0d955aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.56.225.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T20:05:11.000Z",
      "valid_until": "2026-05-04T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T20:03:09.167Z",
      "x_nadsec_last_seen": "2026-04-02T20:05:14.443Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134008"
      ],
      "x_nadsec_orgs": [
        "T10 Networks"
      ]
    },
    {
      "created": "2026-04-02T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--00243fc8-dc7d-4c7d-9769-2dd3f83a05b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.160.149.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T20:05:11.000Z",
      "valid_until": "2026-05-04T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T20:01:13.053Z",
      "x_nadsec_last_seen": "2026-04-02T20:03:17.890Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-02T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--2fdf135c-f7d4-486b-9efc-eec7121f0d48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.161.162.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T20:05:11.000Z",
      "valid_until": "2026-05-04T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T19:58:01.508Z",
      "x_nadsec_last_seen": "2026-04-02T20:00:06.754Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-02T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--2f5937b2-b984-4c17-a562-0a7388fc1f80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.185.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T20:05:11.000Z",
      "valid_until": "2026-05-04T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T19:49:40.475Z",
      "x_nadsec_last_seen": "2026-04-02T19:50:00.004Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-02T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--46a3bc73-7c1f-4a2d-9593-462207dff9c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.245.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T20:05:11.000Z",
      "valid_until": "2026-05-04T20:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-02T19:08:21.707Z",
      "x_nadsec_last_seen": "2026-04-02T19:08:46.677Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-02T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=epmapper; ports=135; cc=US; asn=46783; asn_org=EASY LINK LLC",
      "id": "indicator--22838282-79e3-4d7b-a470-b434513f7856",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.50.110.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T20:05:11.000Z",
      "valid_until": "2026-05-04T20:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-02T19:42:54.808Z",
      "x_nadsec_last_seen": "2026-04-02T19:42:56.805Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "46783"
      ],
      "x_nadsec_orgs": [
        "EASY LINK LLC"
      ]
    },
    {
      "created": "2026-04-02T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--fe695f2d-a143-4d53-9ff5-cda847ef5901",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T20:05:11.000Z",
      "valid_until": "2026-05-04T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T20:03:23.721Z",
      "x_nadsec_last_seen": "2026-04-02T20:03:23.721Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-02T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--eb0c2cc5-3356-477d-ab73-715464d23f54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T20:05:11.000Z",
      "valid_until": "2026-05-04T20:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-02T19:35:08.016Z",
      "x_nadsec_last_seen": "2026-04-03T17:21:28.293Z",
      "x_nadsec_ports": [
        "445",
        "1723"
      ],
      "x_nadsec_services": [
        "smbd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-02T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=UA; asn=25133; asn_org=LLC McLaut-Invest; user(top)=**",
      "id": "indicator--08fb4558-52d0-44b6-a2f2-264a051d5fbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '78.137.5.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T20:05:11.000Z",
      "valid_until": "2026-05-04T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-02T19:28:59.242Z",
      "x_nadsec_last_seen": "2026-04-02T19:28:59.242Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "25133"
      ],
      "x_nadsec_orgs": [
        "LLC McLaut-Invest"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-02T21:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=133661; asn_org=Netplus Broadband Services Private Limited",
      "id": "indicator--6a0a765c-03d7-4e96-8c00-122ac6769711",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T21:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.223.8.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T21:05:12.000Z",
      "valid_until": "2026-05-04T21:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-02T20:31:24.008Z",
      "x_nadsec_last_seen": "2026-04-02T21:21:18.425Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133661"
      ],
      "x_nadsec_orgs": [
        "Netplus Broadband Services Private Limited"
      ]
    },
    {
      "created": "2026-04-02T21:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--955788cd-d3f3-47a9-ad3e-b52da5155980",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T21:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.211.16.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T21:05:12.000Z",
      "valid_until": "2026-05-04T21:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-02T20:17:20.271Z",
      "x_nadsec_last_seen": "2026-04-02T20:52:37.396Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-02T21:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--a9fa7926-f0f2-4946-8591-2b65b7b371e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T21:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.185.129.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T21:05:12.000Z",
      "valid_until": "2026-05-04T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T20:49:36.732Z",
      "x_nadsec_last_seen": "2026-04-02T20:49:36.771Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-02T21:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--29c24912-3846-4f70-8fbd-7807dc152585",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T21:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '39.52.56.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T21:05:12.000Z",
      "valid_until": "2026-05-04T21:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-02T21:01:42.400Z",
      "x_nadsec_last_seen": "2026-04-02T21:09:25.839Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-04-02T21:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MZ; asn=327700; asn_org=MoRENet",
      "id": "indicator--c95287ec-b7e6-46fb-84b4-a765cb9ff621",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T21:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.94.105.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T21:05:12.000Z",
      "valid_until": "2026-05-04T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T20:12:20.962Z",
      "x_nadsec_last_seen": "2026-04-02T20:12:21.081Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MZ"
      ],
      "x_nadsec_asns": [
        "327700"
      ],
      "x_nadsec_orgs": [
        "MoRENet"
      ]
    },
    {
      "created": "2026-04-02T21:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mirrord; ports=42; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--096fd641-1529-4971-be0d-a1de640e09a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T21:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T21:05:12.000Z",
      "valid_until": "2026-05-04T21:05:09.000Z",
      "x_nadsec_event_count": 19,
      "x_nadsec_first_seen": "2026-04-02T20:48:01.825Z",
      "x_nadsec_last_seen": "2026-04-22T05:33:22.974Z",
      "x_nadsec_ports": [
        "42",
        "81",
        "445",
        "1433",
        "3306",
        "32805",
        "39995",
        "42423",
        "43639",
        "46679"
      ],
      "x_nadsec_services": [
        "httpd",
        "mirrorc",
        "mirrord",
        "smbd",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-02T23:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--a4c882e0-923c-4618-8eba-3ce631607452",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T23:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.161.212.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T23:05:11.000Z",
      "valid_until": "2026-05-04T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T22:22:53.989Z",
      "x_nadsec_last_seen": "2026-04-02T22:24:58.848Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-02T23:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--632b18c7-a1b7-42ce-9144-b3d3c8d8b79a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T23:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T23:05:11.000Z",
      "valid_until": "2026-05-04T23:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T22:32:45.986Z",
      "x_nadsec_last_seen": "2026-04-23T02:34:13.248Z",
      "x_nadsec_ports": [
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-03T00:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--90075e26-3bad-4436-9eb8-61b571e0c3bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T00:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '187.172.40.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T00:05:21.000Z",
      "valid_until": "2026-05-05T00:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T00:01:06.464Z",
      "x_nadsec_last_seen": "2026-04-03T00:03:11.798Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-04-03T00:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=mysqld; ports=3306; cc=RO; asn=47890; asn_org=Unmanaged Ltd",
      "id": "indicator--f1c04873-7208-4f7a-8d22-ad5028350d27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T00:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '193.32.162.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T00:05:21.000Z",
      "valid_until": "2026-05-05T00:05:10.000Z",
      "x_nadsec_event_count": 133,
      "x_nadsec_first_seen": "2026-04-02T23:29:32.748Z",
      "x_nadsec_last_seen": "2026-04-30T11:54:58.805Z",
      "x_nadsec_ports": [
        "445",
        "3306",
        "27017",
        "81"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld",
        "smbd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "RO"
      ],
      "x_nadsec_asns": [
        "47890"
      ],
      "x_nadsec_orgs": [
        "Unmanaged Ltd"
      ]
    },
    {
      "created": "2026-04-03T00:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e822348b-aec2-4e52-8ec7-7dbc9c785f1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T00:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T00:05:21.000Z",
      "valid_until": "2026-05-05T00:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T00:04:52.341Z",
      "x_nadsec_last_seen": "2026-04-03T00:04:52.341Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-03T00:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=RU; asn=210259; asn_org=LLC Applied Computational Technologies; user(top)=r**t",
      "id": "indicator--6a4cf02f-4f5c-42a7-a890-cbec26368e05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T00:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '81.29.142.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T00:05:21.000Z",
      "valid_until": "2026-05-05T00:05:10.000Z",
      "x_nadsec_event_count": 69,
      "x_nadsec_first_seen": "2026-04-02T23:54:04.113Z",
      "x_nadsec_last_seen": "2026-04-29T17:30:00.119Z",
      "x_nadsec_ports": [
        "1883",
        "3306",
        "27017",
        "135",
        "1433",
        "445",
        "21"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mongod",
        "mysqld",
        "epmapper",
        "mssqld",
        "smbd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "210259"
      ],
      "x_nadsec_orgs": [
        "LLC Applied Computational Technologies"
      ],
      "x_nadsec_usernames_attempted": [
        "***",
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-03T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--95e58966-14ea-474d-b4e6-6c2f3b8eaf38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '125.107.82.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T01:05:13.000Z",
      "valid_until": "2026-05-05T01:05:09.000Z",
      "x_nadsec_event_count": 45,
      "x_nadsec_first_seen": "2026-04-03T00:19:04.542Z",
      "x_nadsec_last_seen": "2026-04-03T00:21:31.323Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-03T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6aeec5a0-78bd-4b9f-90e3-8c1e7b9659df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '134.122.104.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T01:05:13.000Z",
      "valid_until": "2026-05-05T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T00:17:07.257Z",
      "x_nadsec_last_seen": "2026-04-03T00:17:07.257Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-03T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--97f5ab4b-2c8a-4b1b-855d-3c63d2a20e91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T01:05:13.000Z",
      "valid_until": "2026-05-05T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T00:54:18.869Z",
      "x_nadsec_last_seen": "2026-04-03T00:54:18.869Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-03T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=37549; asn_org=Innovative_Networks",
      "id": "indicator--533156ae-aedd-4211-af56-54c9a87b1ad6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.73.142.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T01:05:13.000Z",
      "valid_until": "2026-05-05T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T00:23:12.857Z",
      "x_nadsec_last_seen": "2026-04-03T00:25:20.864Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "37549"
      ],
      "x_nadsec_orgs": [
        "Innovative_Networks"
      ]
    },
    {
      "created": "2026-04-03T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=SC; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--6a00c25f-11c7-48f9-bfef-9862879271f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T01:05:13.000Z",
      "valid_until": "2026-05-05T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T00:51:53.921Z",
      "x_nadsec_last_seen": "2026-04-03T00:51:53.921Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-04-03T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a06d57a3-6d69-47db-8d9c-2a46d5bc8192",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T01:05:13.000Z",
      "valid_until": "2026-05-05T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-03T00:19:13.701Z",
      "x_nadsec_last_seen": "2026-04-14T06:07:47.964Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-03T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--356f30f6-e511-4a1e-930d-07b98cdd73da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '54.164.79.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T01:05:13.000Z",
      "valid_until": "2026-05-05T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T00:56:00.051Z",
      "x_nadsec_last_seen": "2026-04-03T00:56:00.051Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-03T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=CN; asn=401696; asn_org=cognetcloud INC; user(top)=**",
      "id": "indicator--f0ccb702-45f3-4a48-8826-4ed95b675391",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.85.226.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T02:05:11.000Z",
      "valid_until": "2026-05-05T02:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-03T01:23:03.186Z",
      "x_nadsec_last_seen": "2026-04-03T01:23:09.035Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "401696"
      ],
      "x_nadsec_orgs": [
        "cognetcloud INC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-03T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--49c4953e-b0e9-4f87-9671-3a78177ce59d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.91.94.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T02:05:11.000Z",
      "valid_until": "2026-05-05T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T01:28:11.922Z",
      "x_nadsec_last_seen": "2026-04-14T13:07:30.647Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-03T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--fb22eaf4-36ed-4459-8edd-59e48d38dc9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '222.253.52.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T02:05:11.000Z",
      "valid_until": "2026-05-05T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T01:25:33.016Z",
      "x_nadsec_last_seen": "2026-04-03T01:27:37.906Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-03T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--258f9adf-d3ba-47b4-9c55-6d1e48f1d39b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.124.186.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T02:05:11.000Z",
      "valid_until": "2026-05-05T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T01:23:56.176Z",
      "x_nadsec_last_seen": "2026-04-03T01:23:56.176Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-03T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--ec9dc9b8-d752-43e9-b5a1-dacc46bc7d4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T02:05:11.000Z",
      "valid_until": "2026-05-05T02:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-03T01:09:58.150Z",
      "x_nadsec_last_seen": "2026-04-21T10:32:14.373Z",
      "x_nadsec_ports": [
        "445",
        "135"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-03T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--a06b0608-4886-4f58-a792-1f8efd0a3345",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T02:05:11.000Z",
      "valid_until": "2026-05-05T02:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-03T01:53:58.070Z",
      "x_nadsec_last_seen": "2026-04-03T01:54:14.411Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-03T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.; user(top)=**",
      "id": "indicator--26046a71-8a61-45df-9908-df2694d972f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '181.91.173.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T03:05:11.000Z",
      "valid_until": "2026-05-05T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T02:44:03.765Z",
      "x_nadsec_last_seen": "2026-04-03T02:44:03.765Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7303"
      ],
      "x_nadsec_orgs": [
        "Telecom Argentina S.A."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-03T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=28343; asn_org=UNIFIQUE TELECOMUNICACOES SA",
      "id": "indicator--77031102-1e5c-4cff-9f4a-6eb2ead03ef2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.237.144.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T03:05:11.000Z",
      "valid_until": "2026-05-05T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T02:47:42.357Z",
      "x_nadsec_last_seen": "2026-04-03T02:49:48.944Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28343"
      ],
      "x_nadsec_orgs": [
        "UNIFIQUE TELECOMUNICACOES SA"
      ]
    },
    {
      "created": "2026-04-03T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--fa5ee95b-cb79-4002-9c34-340e8990d513",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T03:05:11.000Z",
      "valid_until": "2026-05-05T03:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-03T02:19:08.678Z",
      "x_nadsec_last_seen": "2026-04-30T08:08:54.956Z",
      "x_nadsec_ports": [
        "81",
        "1723"
      ],
      "x_nadsec_services": [
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-03T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=RU; asn=48327; asn_org=Ray-Svyaz Ltd.",
      "id": "indicator--d3d206f3-8349-4222-92d4-67489beace8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '31.135.34.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T03:05:11.000Z",
      "valid_until": "2026-05-05T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-03T02:31:46.355Z",
      "x_nadsec_last_seen": "2026-04-03T02:31:47.805Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48327"
      ],
      "x_nadsec_orgs": [
        "Ray-Svyaz Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-03T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=NL; asn=206264; asn_org=Amarutu Technology Ltd",
      "id": "indicator--ff5dc5ca-5de6-410a-9b17-ab248514723f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.187.35.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T03:05:11.000Z",
      "valid_until": "2026-05-05T03:05:09.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-04-03T02:46:07.891Z",
      "x_nadsec_last_seen": "2026-04-28T03:41:05.940Z",
      "x_nadsec_ports": [
        "81",
        "21",
        "1433",
        "1723",
        "42",
        "135",
        "445",
        "1883",
        "36109"
      ],
      "x_nadsec_services": [
        "httpd",
        "ftpd",
        "mssqld",
        "pptpd",
        "epmapper",
        "mirrorc",
        "mirrord",
        "mqttd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "206264"
      ],
      "x_nadsec_orgs": [
        "Amarutu Technology Ltd"
      ]
    },
    {
      "created": "2026-04-03T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--917355fe-5f38-4b46-8f63-ddc8e417f93d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T03:05:11.000Z",
      "valid_until": "2026-05-05T03:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-03T02:36:06.307Z",
      "x_nadsec_last_seen": "2026-04-08T18:32:56.458Z",
      "x_nadsec_ports": [
        "21",
        "1433",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-03T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=mysqld; ports=3306; cc=RU; asn=210259; asn_org=LLC Applied Computational Technologies; user(top)=r**t",
      "id": "indicator--221c2636-d37a-4ec1-a6c0-678c58f6dcf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '81.29.142.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T03:05:11.000Z",
      "valid_until": "2026-05-05T03:05:09.000Z",
      "x_nadsec_event_count": 27,
      "x_nadsec_first_seen": "2026-04-03T02:33:28.790Z",
      "x_nadsec_last_seen": "2026-04-27T19:37:13.528Z",
      "x_nadsec_ports": [
        "1883",
        "27017",
        "21",
        "135",
        "1433",
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mongod",
        "ftpd",
        "epmapper",
        "mssqld",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "210259"
      ],
      "x_nadsec_orgs": [
        "LLC Applied Computational Technologies"
      ],
      "x_nadsec_usernames_attempted": [
        "***",
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-03T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IT; asn=3269; asn_org=TIM",
      "id": "indicator--cd138068-f2cf-4e63-aeec-c6556b48fc7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.85.249.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T03:05:11.000Z",
      "valid_until": "2026-05-05T03:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-03T02:50:57.485Z",
      "x_nadsec_last_seen": "2026-04-03T02:57:57.272Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "3269"
      ],
      "x_nadsec_orgs": [
        "TIM"
      ]
    },
    {
      "created": "2026-04-03T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--da92ebc7-96eb-4d8f-8acb-de86e55ce09e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '110.139.54.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T04:05:03.000Z",
      "valid_until": "2026-05-05T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T03:26:27.806Z",
      "x_nadsec_last_seen": "2026-04-03T03:28:32.806Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-03T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=28573; asn_org=Claro NXT Telecomunicacoes Ltda",
      "id": "indicator--512a5016-5c4f-49a0-b58e-c9e6b76132a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '179.152.173.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T04:05:03.000Z",
      "valid_until": "2026-05-05T04:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-03T03:34:37.904Z",
      "x_nadsec_last_seen": "2026-04-03T03:39:42.823Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28573"
      ],
      "x_nadsec_orgs": [
        "Claro NXT Telecomunicacoes Ltda"
      ]
    },
    {
      "created": "2026-04-03T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--397b98c5-e861-49da-9fc0-3cd77bfd2c6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.8.178.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T04:05:03.000Z",
      "valid_until": "2026-05-05T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T03:26:56.884Z",
      "x_nadsec_last_seen": "2026-04-03T03:26:56.884Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-04-03T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--97552c77-ae80-40c5-916a-c82b45869748",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.8.183.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T04:05:03.000Z",
      "valid_until": "2026-05-05T04:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-03T03:26:56.756Z",
      "x_nadsec_last_seen": "2026-04-03T03:29:01.880Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-04-03T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--a599e3b6-1cf9-4447-ac6f-ff1561587dcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '183.82.184.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T04:05:03.000Z",
      "valid_until": "2026-05-05T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T03:55:44.712Z",
      "x_nadsec_last_seen": "2026-04-03T03:57:50.459Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-04-03T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--65496c9d-9f6e-4cb4-bcf3-9654231a3ce0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T04:05:03.000Z",
      "valid_until": "2026-05-05T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T03:59:45.308Z",
      "x_nadsec_last_seen": "2026-04-03T03:59:45.308Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-03T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--5d109097-8b49-47f3-9284-f3b04fc7d110",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T04:05:03.000Z",
      "valid_until": "2026-05-05T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-03T03:59:45.066Z",
      "x_nadsec_last_seen": "2026-04-29T14:58:58.864Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-03T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--d0e50b40-1aa4-4555-87e1-6cc0cff846a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T04:05:03.000Z",
      "valid_until": "2026-05-05T04:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-03T03:59:49.893Z",
      "x_nadsec_last_seen": "2026-04-03T03:59:50.944Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-03T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MN; asn=9484; asn_org=Mobinet LLC. AS Mobinet Internet Service Provider",
      "id": "indicator--793007cb-267b-42b1-ae1c-13a49f7c68c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '202.126.94.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T04:05:03.000Z",
      "valid_until": "2026-05-05T04:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-03T03:37:32.950Z",
      "x_nadsec_last_seen": "2026-04-03T03:44:41.961Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "9484"
      ],
      "x_nadsec_orgs": [
        "Mobinet LLC. AS Mobinet Internet Service Provider"
      ]
    },
    {
      "created": "2026-04-03T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--8c4cb910-9a56-4f6d-a25b-0c8cfeed0f31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.53.175.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T04:05:03.000Z",
      "valid_until": "2026-05-05T04:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-03T03:57:31.099Z",
      "x_nadsec_last_seen": "2026-04-23T06:03:55.268Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-04-03T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=mongod; ports=27017; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--1d36807e-2d4f-482d-a6e2-6eb357639169",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T04:05:03.000Z",
      "valid_until": "2026-05-05T04:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-03T03:56:18.396Z",
      "x_nadsec_last_seen": "2026-04-03T03:57:33.025Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-04-03T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--6c0f6e20-6f4d-455b-a9d0-8532c2a84abd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T04:05:03.000Z",
      "valid_until": "2026-05-05T04:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-03T03:56:02.107Z",
      "x_nadsec_last_seen": "2026-04-03T03:56:48.110Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-04-03T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--0e779e73-9071-4794-b3bb-737b97b7ab83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T04:05:03.000Z",
      "valid_until": "2026-05-05T04:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-03T03:56:02.614Z",
      "x_nadsec_last_seen": "2026-04-03T03:57:22.452Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-04-03T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--0c3eead4-8f85-4c47-b954-d70ae6e1d0e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T04:05:03.000Z",
      "valid_until": "2026-05-05T04:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-04-03T03:17:26.915Z",
      "x_nadsec_last_seen": "2026-04-25T10:43:38.683Z",
      "x_nadsec_ports": [
        "81",
        "445",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "httpd",
        "smbd",
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-03T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BI; asn=37545; asn_org=BBSS; user(top)=**",
      "id": "indicator--e19ada8e-071f-4f34-9b7b-df295da2ffca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.134.100.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:05:11.000Z",
      "valid_until": "2026-05-05T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T04:16:32.891Z",
      "x_nadsec_last_seen": "2026-04-03T04:16:32.891Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BI"
      ],
      "x_nadsec_asns": [
        "37545"
      ],
      "x_nadsec_orgs": [
        "BBSS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-03T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mongod; ports=27017; cc=FR; asn=51167; asn_org=Contabo GmbH",
      "id": "indicator--7b30cf68-e6d3-40fd-b532-f883571ddc93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '157.173.100.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:05:11.000Z",
      "valid_until": "2026-05-05T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T04:13:10.218Z",
      "x_nadsec_last_seen": "2026-04-03T04:13:32.122Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "51167"
      ],
      "x_nadsec_orgs": [
        "Contabo GmbH"
      ]
    },
    {
      "created": "2026-04-03T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=38972; asn_org=Suhoy Log Intersat Ltd.",
      "id": "indicator--b8268bfc-5c98-4fb1-a71d-e37f200a7592",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.254.24.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:05:11.000Z",
      "valid_until": "2026-05-05T05:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-03T04:22:12.599Z",
      "x_nadsec_last_seen": "2026-04-21T18:23:29.437Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "38972"
      ],
      "x_nadsec_orgs": [
        "Suhoy Log Intersat Ltd."
      ]
    },
    {
      "created": "2026-04-03T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=XK; asn=21246; asn_org=IPKO Telecommunications LLC",
      "id": "indicator--ba544025-1fd6-49d1-b810-dde8363986ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.99.138.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:05:11.000Z",
      "valid_until": "2026-05-05T05:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-03T04:35:25.680Z",
      "x_nadsec_last_seen": "2026-04-03T04:42:28.942Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "XK"
      ],
      "x_nadsec_asns": [
        "21246"
      ],
      "x_nadsec_orgs": [
        "IPKO Telecommunications LLC"
      ]
    },
    {
      "created": "2026-04-03T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=55577; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--9341b990-5d27-4a6e-bd56-351ba647eb05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '49.205.253.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:05:11.000Z",
      "valid_until": "2026-05-05T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T04:53:50.256Z",
      "x_nadsec_last_seen": "2026-04-03T04:55:55.210Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55577"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-04-03T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=58693; asn_org=NNI",
      "id": "indicator--3ac03743-242e-4f39-8d1e-a691466f80aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '49.249.228.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:05:11.000Z",
      "valid_until": "2026-05-05T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T04:55:18.718Z",
      "x_nadsec_last_seen": "2026-04-03T04:57:24.531Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "58693"
      ],
      "x_nadsec_orgs": [
        "NNI"
      ]
    },
    {
      "created": "2026-04-03T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=401626; asn_org=Netiface America, Inc.",
      "id": "indicator--fc6a62d4-3621-4c46-880e-6dafe987491c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:05:11.000Z",
      "valid_until": "2026-05-05T05:05:09.000Z",
      "x_nadsec_event_count": 19,
      "x_nadsec_first_seen": "2026-04-03T04:36:45.078Z",
      "x_nadsec_last_seen": "2026-04-26T00:01:16.094Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ]
    },
    {
      "created": "2026-04-03T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=RU; asn=44050; asn_org=Petersburg Internet Network ltd.",
      "id": "indicator--6face142-5525-47fe-9bfc-ce797db0f2cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '95.215.0.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:05:11.000Z",
      "valid_until": "2026-05-05T05:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-03T04:32:33.363Z",
      "x_nadsec_last_seen": "2026-04-29T18:47:33.254Z",
      "x_nadsec_ports": [
        "27017",
        "3306",
        "1433"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "44050"
      ],
      "x_nadsec_orgs": [
        "Petersburg Internet Network ltd."
      ]
    },
    {
      "created": "2026-04-03T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--fa08a2a2-89d3-4c56-a2cd-ece575ecbc07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.160.185.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T06:05:11.000Z",
      "valid_until": "2026-05-05T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T05:54:59.635Z",
      "x_nadsec_last_seen": "2026-04-03T05:57:04.467Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-03T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LK; asn=18001; asn_org=Dialog Axiata PLC.",
      "id": "indicator--c492e768-325f-4a50-82e6-43f529f54051",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '123.231.8.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T06:05:11.000Z",
      "valid_until": "2026-05-05T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T05:35:56.709Z",
      "x_nadsec_last_seen": "2026-04-03T05:38:02.205Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "18001"
      ],
      "x_nadsec_orgs": [
        "Dialog Axiata PLC."
      ]
    },
    {
      "created": "2026-04-03T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d1be2d62-4093-4637-828f-dabff3a7fdfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.222.40.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T06:05:11.000Z",
      "valid_until": "2026-05-05T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-03T05:39:26.452Z",
      "x_nadsec_last_seen": "2026-04-03T05:39:26.843Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-03T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--3308ce26-ce6c-4d80-a253-5a75261bdda7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T06:05:11.000Z",
      "valid_until": "2026-05-05T06:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-03T05:47:03.139Z",
      "x_nadsec_last_seen": "2026-04-12T20:41:24.574Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-03T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--6b57b974-65ce-40c1-9b01-0b33ce04a03d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T06:05:11.000Z",
      "valid_until": "2026-05-05T06:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-04-03T05:09:14.001Z",
      "x_nadsec_last_seen": "2026-04-25T05:56:33.540Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-04-03T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=RU; asn=214664; asn_org=JSC Buduschee",
      "id": "indicator--1351e28d-90c1-4d3b-9013-98c90792cd0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.91.64.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T06:05:11.000Z",
      "valid_until": "2026-05-05T06:05:09.000Z",
      "x_nadsec_event_count": 24,
      "x_nadsec_first_seen": "2026-04-03T05:40:20.599Z",
      "x_nadsec_last_seen": "2026-04-25T22:58:47.054Z",
      "x_nadsec_ports": [
        "27017",
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "mongod",
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "214664"
      ],
      "x_nadsec_orgs": [
        "JSC Buduschee"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a*******s"
      ]
    },
    {
      "created": "2026-04-03T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--e28225b2-baa4-481f-a59e-3c594ab7f92b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T06:05:11.000Z",
      "valid_until": "2026-05-05T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T05:30:59.958Z",
      "x_nadsec_last_seen": "2026-04-03T05:30:59.958Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-03T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=FR; asn=207043; asn_org=Dedik Services Limited",
      "id": "indicator--c7b85c07-2572-4434-b1b2-6a595f764dc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '82.25.63.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T06:05:11.000Z",
      "valid_until": "2026-05-05T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-03T05:36:16.408Z",
      "x_nadsec_last_seen": "2026-04-05T09:15:16.569Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "207043"
      ],
      "x_nadsec_orgs": [
        "Dedik Services Limited"
      ]
    },
    {
      "created": "2026-04-03T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--61569488-2bd7-467b-8e28-1f4b1e272878",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '95.37.33.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T06:05:11.000Z",
      "valid_until": "2026-05-05T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-03T05:45:37.261Z",
      "x_nadsec_last_seen": "2026-04-03T05:46:59.814Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-03T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CO; asn=3816; asn_org=COLOMBIA TELECOMUNICACIONES S.A. ESP BIC; user(top)=**",
      "id": "indicator--a60879b8-e50c-415e-a618-7293a59e5851",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '179.32.58.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T07:05:11.000Z",
      "valid_until": "2026-05-05T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T06:59:48.645Z",
      "x_nadsec_last_seen": "2026-04-03T06:59:48.645Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "3816"
      ],
      "x_nadsec_orgs": [
        "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-03T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--d934f1e9-b985-4f34-8ea6-166fbee850c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.9.33.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T07:05:11.000Z",
      "valid_until": "2026-05-05T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T06:56:00.152Z",
      "x_nadsec_last_seen": "2026-04-03T06:58:05.512Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-04-03T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--11fbe8e3-96ff-40c9-9aca-41f9092ac1dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.44.217.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T07:05:11.000Z",
      "valid_until": "2026-05-05T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T06:08:30.244Z",
      "x_nadsec_last_seen": "2026-04-03T06:10:36.579Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-03T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=63025; asn_org=NOHAVPS LLC",
      "id": "indicator--a57293cf-189f-42a0-8bca-d67453289309",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.23.185.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T07:05:11.000Z",
      "valid_until": "2026-05-05T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T06:56:38.005Z",
      "x_nadsec_last_seen": "2026-04-03T06:56:38.005Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63025"
      ],
      "x_nadsec_orgs": [
        "NOHAVPS LLC"
      ]
    },
    {
      "created": "2026-04-03T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--b58ed04c-fcce-4669-9926-f83d21267649",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '2.63.250.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T07:05:11.000Z",
      "valid_until": "2026-05-05T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T06:17:49.129Z",
      "x_nadsec_last_seen": "2026-04-03T06:19:55.736Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-03T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--9cf74dc2-98df-4ac7-965b-2681002e11f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T07:05:11.000Z",
      "valid_until": "2026-05-05T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T06:34:53.544Z",
      "x_nadsec_last_seen": "2026-04-03T06:34:53.544Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-03T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--71fa9a05-b14e-4624-bbd6-17cd74b2bd1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '88.247.99.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T07:05:11.000Z",
      "valid_until": "2026-05-05T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-03T06:43:18.855Z",
      "x_nadsec_last_seen": "2026-04-03T06:50:31.337Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-03T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=41633; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--ed42c9a0-3a74-4cef-929a-b8ad71df97f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T07:05:11.000Z",
      "valid_until": "2026-05-05T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-03T06:38:12.501Z",
      "x_nadsec_last_seen": "2026-04-03T06:38:12.506Z",
      "x_nadsec_ports": [
        "42",
        "41633"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-03T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrord; ports=42; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--febbebd8-b5f1-41f9-8623-ec5e32608935",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T07:05:11.000Z",
      "valid_until": "2026-05-05T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-03T06:38:11.381Z",
      "x_nadsec_last_seen": "2026-04-03T06:38:11.384Z",
      "x_nadsec_ports": [
        "42",
        "33969"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-03T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=452; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--91912259-f5a9-4ad8-9186-f55782f00686",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '125.227.246.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T08:05:10.000Z",
      "valid_until": "2026-05-05T08:05:09.000Z",
      "x_nadsec_event_count": 3168,
      "x_nadsec_first_seen": "2026-04-03T07:55:04.595Z",
      "x_nadsec_last_seen": "2026-04-03T08:43:16.485Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-03T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--6cbe56e8-72e0-445c-81af-5b40b8a9f003",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '171.213.227.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T08:05:10.000Z",
      "valid_until": "2026-05-05T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-03T07:38:10.182Z",
      "x_nadsec_last_seen": "2026-04-03T07:38:34.544Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-03T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MD; asn=31252; asn_org=StarNet Solutii SRL",
      "id": "indicator--4685f6ef-a0a2-440e-991f-935e8069f7bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.70.189.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T08:05:10.000Z",
      "valid_until": "2026-05-05T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-03T07:14:04.445Z",
      "x_nadsec_last_seen": "2026-04-03T07:14:04.594Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MD"
      ],
      "x_nadsec_asns": [
        "31252"
      ],
      "x_nadsec_orgs": [
        "StarNet Solutii SRL"
      ]
    },
    {
      "created": "2026-04-03T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--07ab7a41-a7e5-4d54-ae39-71fbe9525f2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '2.60.246.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T08:05:10.000Z",
      "valid_until": "2026-05-05T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-03T07:59:48.316Z",
      "x_nadsec_last_seen": "2026-04-03T08:07:41.414Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-03T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--f35c260b-42df-432d-9de9-77fea4140c59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '27.77.23.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T08:05:10.000Z",
      "valid_until": "2026-05-05T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T07:09:58.349Z",
      "x_nadsec_last_seen": "2026-04-03T07:09:58.349Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-03T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=UA; asn=24812; asn_org=RPC HomeNet Ltd.",
      "id": "indicator--b058ba1d-77a0-4416-b892-42899a20f985",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.98.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T08:05:10.000Z",
      "valid_until": "2026-05-05T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-03T07:38:15.572Z",
      "x_nadsec_last_seen": "2026-04-03T07:43:05.545Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "24812"
      ],
      "x_nadsec_orgs": [
        "RPC HomeNet Ltd."
      ]
    },
    {
      "created": "2026-04-03T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--5a42249e-1aaa-48e6-afb7-200fb1641454",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.89.76.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T09:05:11.000Z",
      "valid_until": "2026-05-05T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T08:07:33.409Z",
      "x_nadsec_last_seen": "2026-04-03T08:09:40.869Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-04-03T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=135191; asn_org=HARKYAL TELE SERVICES PRIVATE LIMITED",
      "id": "indicator--c05a43d1-fbe9-4f6b-9fe0-80b56aae9e8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.217.77.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T09:05:11.000Z",
      "valid_until": "2026-05-05T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T08:08:31.756Z",
      "x_nadsec_last_seen": "2026-04-03T08:10:36.862Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135191"
      ],
      "x_nadsec_orgs": [
        "HARKYAL TELE SERVICES PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-04-03T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=132770; asn_org=Gazon Communications India Limited",
      "id": "indicator--e5477bac-e063-4084-8069-37a990bc237d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.93.240.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T09:05:11.000Z",
      "valid_until": "2026-05-05T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T08:49:37.792Z",
      "x_nadsec_last_seen": "2026-04-03T08:49:43.444Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132770"
      ],
      "x_nadsec_orgs": [
        "Gazon Communications India Limited"
      ]
    },
    {
      "created": "2026-04-03T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--19104ba8-7aab-4de7-b79d-dadc6bf98fcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '122.160.53.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T09:05:11.000Z",
      "valid_until": "2026-05-05T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T09:04:18.571Z",
      "x_nadsec_last_seen": "2026-04-03T09:06:23.399Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-04-03T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--918e69e4-89f0-408c-9c8e-a8c8467dd540",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '123.21.104.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T09:05:11.000Z",
      "valid_until": "2026-05-05T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-03T08:30:41.923Z",
      "x_nadsec_last_seen": "2026-04-03T08:37:15.648Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-03T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--a366aacf-d8de-48d4-8eaf-6eb1d15437b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.169.93.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T09:05:11.000Z",
      "valid_until": "2026-05-05T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T08:14:59.535Z",
      "x_nadsec_last_seen": "2026-04-03T08:17:04.419Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-03T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--975c5182-1ef3-4013-bce1-2ff3dc10c96b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '203.210.157.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T09:05:11.000Z",
      "valid_until": "2026-05-05T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-03T08:55:14.876Z",
      "x_nadsec_last_seen": "2026-04-03T09:02:10.117Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-03T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--7201f965-c55a-4ccb-a0ee-5d33fe7c9240",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T09:05:11.000Z",
      "valid_until": "2026-05-05T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T08:32:04.382Z",
      "x_nadsec_last_seen": "2026-04-03T08:32:04.382Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-03T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--9e034cdd-3d83-43fa-85e3-4add99331489",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '81.214.72.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T09:05:11.000Z",
      "valid_until": "2026-05-05T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-03T08:24:38.225Z",
      "x_nadsec_last_seen": "2026-04-03T08:31:44.466Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-03T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=24835; asn_org=RAYA Telecom - Egypt",
      "id": "indicator--f0d1a70e-b01d-469b-b532-2e0a9ae5081d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.221.149.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T10:05:11.000Z",
      "valid_until": "2026-05-05T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T09:17:52.475Z",
      "x_nadsec_last_seen": "2026-04-03T09:19:59.193Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24835"
      ],
      "x_nadsec_orgs": [
        "RAYA Telecom - Egypt"
      ]
    },
    {
      "created": "2026-04-03T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c0fd4250-2eba-4251-81c3-e9931f08d9a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.163.15.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T10:05:11.000Z",
      "valid_until": "2026-05-05T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T09:20:14.518Z",
      "x_nadsec_last_seen": "2026-04-03T09:20:14.518Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-03T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e60bbfca-3497-4136-bca6-9e664e875f2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.169.80.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T10:05:11.000Z",
      "valid_until": "2026-05-05T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T09:57:33.600Z",
      "x_nadsec_last_seen": "2026-04-03T09:57:33.600Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-03T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=KG; asn=12997; asn_org=OJSC Kyrgyztelecom",
      "id": "indicator--c9c82276-de8b-4ecb-b660-01cc09a4be99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.113.28.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T10:05:11.000Z",
      "valid_until": "2026-05-05T10:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-03T09:33:56.202Z",
      "x_nadsec_last_seen": "2026-04-03T09:35:29.529Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KG"
      ],
      "x_nadsec_asns": [
        "12997"
      ],
      "x_nadsec_orgs": [
        "OJSC Kyrgyztelecom"
      ]
    },
    {
      "created": "2026-04-03T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--8fb69c7f-367d-4c2a-a2b5-888d0a47288d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '112.28.144.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T11:05:10.000Z",
      "valid_until": "2026-05-05T11:05:09.000Z",
      "x_nadsec_event_count": 45,
      "x_nadsec_first_seen": "2026-04-03T10:09:54.893Z",
      "x_nadsec_last_seen": "2026-04-03T10:12:39.314Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-04-03T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e4eb50d3-32d2-4630-b5d5-ab8807c06673",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '13.89.121.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T11:05:10.000Z",
      "valid_until": "2026-05-05T11:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-03T11:03:45.979Z",
      "x_nadsec_last_seen": "2026-04-03T11:03:56.152Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-03T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--9ea85545-90d1-4538-ac92-e2d7edb9202f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.52.226.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T11:05:10.000Z",
      "valid_until": "2026-05-05T11:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-03T10:20:15.666Z",
      "x_nadsec_last_seen": "2026-04-03T10:27:15.275Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-03T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--2995f56e-39d3-494c-a891-f6f68630a2fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.64.97.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T11:05:10.000Z",
      "valid_until": "2026-05-05T11:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-03T11:03:55.347Z",
      "x_nadsec_last_seen": "2026-04-03T11:03:56.074Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-03T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--ed0e731c-6ad4-48ac-813c-0722e3ca318c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '203.210.157.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T11:05:10.000Z",
      "valid_until": "2026-05-05T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T10:08:08.735Z",
      "x_nadsec_last_seen": "2026-04-03T10:10:13.474Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-03T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=NG; asn=37282; asn_org=MAINONE",
      "id": "indicator--4f9c2acf-dbe2-4dde-a93b-316ab57efb40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.75.89.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T11:05:10.000Z",
      "valid_until": "2026-05-05T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T11:03:04.919Z",
      "x_nadsec_last_seen": "2026-04-03T11:05:11.865Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "37282"
      ],
      "x_nadsec_orgs": [
        "MAINONE"
      ]
    },
    {
      "created": "2026-04-03T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--54180ae1-7382-4c59-bf68-7374925a65cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T11:05:10.000Z",
      "valid_until": "2026-05-05T11:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-03T10:24:23.042Z",
      "x_nadsec_last_seen": "2026-04-21T19:51:52.294Z",
      "x_nadsec_ports": [
        "21",
        "135",
        "1433"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-03T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--476123b0-727d-411b-ae11-feaf2b68ae73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T11:05:10.000Z",
      "valid_until": "2026-05-05T11:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T10:37:43.361Z",
      "x_nadsec_last_seen": "2026-04-03T10:37:43.361Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-03T12:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=36994; asn_org=Vodacom-VB",
      "id": "indicator--d109394c-5075-4ad9-9a09-6f4ef96eedb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T12:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '105.246.225.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T12:05:15.000Z",
      "valid_until": "2026-05-05T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T11:32:35.753Z",
      "x_nadsec_last_seen": "2026-04-03T11:34:43.447Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "36994"
      ],
      "x_nadsec_orgs": [
        "Vodacom-VB"
      ]
    },
    {
      "created": "2026-04-03T12:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--09d09e7e-b1e6-4785-8a90-da1b73d349c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T12:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '13.57.33.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T12:05:15.000Z",
      "valid_until": "2026-05-05T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T11:05:40.955Z",
      "x_nadsec_last_seen": "2026-04-03T11:05:40.955Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-03T12:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--9b9b86ef-c95b-4bc9-98b3-0dbbb5c478b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T12:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.236.45.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T12:05:15.000Z",
      "valid_until": "2026-05-05T12:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-03T12:01:01.116Z",
      "x_nadsec_last_seen": "2026-04-03T12:08:03.578Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-04-03T12:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--4838a857-7096-4f1c-930b-cfdf37a4ad5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T12:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.210.226.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T12:05:15.000Z",
      "valid_until": "2026-05-05T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T11:56:56.229Z",
      "x_nadsec_last_seen": "2026-04-03T11:59:03.989Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-04-03T12:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a31b6d67-ef2d-4fcf-8e4f-e6deb065abf7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T12:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.90.249.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T12:05:15.000Z",
      "valid_until": "2026-05-05T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T11:56:41.806Z",
      "x_nadsec_last_seen": "2026-04-03T11:56:41.806Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-03T12:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--e2b0662f-a8f1-44b2-a04f-17ecc9bc8996",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T12:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T12:05:15.000Z",
      "valid_until": "2026-05-05T12:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-03T11:34:13.818Z",
      "x_nadsec_last_seen": "2026-04-27T23:33:37.756Z",
      "x_nadsec_ports": [
        "445",
        "1883"
      ],
      "x_nadsec_services": [
        "smbd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-03T12:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=UA; asn=44894; asn_org=Ukrchermetavtomatika LLC",
      "id": "indicator--10b1e698-4e41-412c-b68f-2b9fe48f1ee2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T12:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.247.76.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T12:05:15.000Z",
      "valid_until": "2026-05-05T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T12:02:18.130Z",
      "x_nadsec_last_seen": "2026-04-03T12:04:24.149Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "44894"
      ],
      "x_nadsec_orgs": [
        "Ukrchermetavtomatika LLC"
      ]
    },
    {
      "created": "2026-04-03T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--6933ece4-f029-4246-adf7-a0d5a5fd7ce1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.91.104.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T13:05:10.000Z",
      "valid_until": "2026-05-05T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T12:53:00.845Z",
      "x_nadsec_last_seen": "2026-04-03T12:53:08.596Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-04-03T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=24547; asn_org=Hebei Mobile Communication Company Limited",
      "id": "indicator--d0acccd8-b5d0-4bbc-98ed-1678efa35438",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '111.11.95.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T13:05:10.000Z",
      "valid_until": "2026-05-05T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-03T13:03:23.504Z",
      "x_nadsec_last_seen": "2026-04-03T13:03:23.580Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "24547"
      ],
      "x_nadsec_orgs": [
        "Hebei Mobile Communication Company Limited"
      ]
    },
    {
      "created": "2026-04-03T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--ade7fa58-ad22-4c72-888a-733746357af2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '123.24.178.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T13:05:10.000Z",
      "valid_until": "2026-05-05T13:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-03T12:55:44.418Z",
      "x_nadsec_last_seen": "2026-04-03T13:00:10.416Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-03T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=BG; asn=48090; asn_org=Techoff Srv Limited",
      "id": "indicator--a71551c8-c6d1-4a93-ae50-2cdd5e75a482",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.178.110.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T13:05:10.000Z",
      "valid_until": "2026-05-05T13:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-03T12:11:10.609Z",
      "x_nadsec_last_seen": "2026-04-29T09:43:21.560Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "48090"
      ],
      "x_nadsec_orgs": [
        "Techoff Srv Limited"
      ]
    },
    {
      "created": "2026-04-03T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=44265; asn_org=OOO Smoltelecom",
      "id": "indicator--1673e375-0cba-4e80-9872-ca6e74a3a584",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.44.41.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T13:05:10.000Z",
      "valid_until": "2026-05-05T13:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-03T12:24:58.740Z",
      "x_nadsec_last_seen": "2026-04-03T12:26:21.234Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "44265"
      ],
      "x_nadsec_orgs": [
        "OOO Smoltelecom"
      ]
    },
    {
      "created": "2026-04-03T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--0e7489d2-51d3-4095-935e-8f6ea16f0179",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '39.61.48.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T13:05:10.000Z",
      "valid_until": "2026-05-05T13:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-03T12:41:58.817Z",
      "x_nadsec_last_seen": "2026-04-23T02:36:44.521Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-04-03T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--2ae2a26c-2f47-4a53-93b1-7686e1979e49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T13:05:10.000Z",
      "valid_until": "2026-05-05T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-03T12:54:47.170Z",
      "x_nadsec_last_seen": "2026-04-29T08:12:43.170Z",
      "x_nadsec_ports": [
        "81",
        "27017"
      ],
      "x_nadsec_services": [
        "httpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-03T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--57884685-6ead-4bde-a54e-0dee4f43b86c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.249.128.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T13:05:10.000Z",
      "valid_until": "2026-05-05T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-03T12:39:26.911Z",
      "x_nadsec_last_seen": "2026-04-03T12:39:37.086Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-03T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IT; asn=12874; asn_org=Fastweb",
      "id": "indicator--409b7e88-af8c-4075-8179-62492ba1b5b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '2.228.82.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T14:05:11.000Z",
      "valid_until": "2026-05-05T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T13:55:29.397Z",
      "x_nadsec_last_seen": "2026-04-03T13:57:36.345Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "12874"
      ],
      "x_nadsec_orgs": [
        "Fastweb"
      ]
    },
    {
      "created": "2026-04-03T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=7922; asn_org=Comcast Cable Communications, LLC",
      "id": "indicator--c1b6fa27-9e1b-485a-bc2f-4212574443c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '50.151.191.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T14:05:11.000Z",
      "valid_until": "2026-05-05T14:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-03T13:47:16.552Z",
      "x_nadsec_last_seen": "2026-04-03T13:47:16.614Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "7922"
      ],
      "x_nadsec_orgs": [
        "Comcast Cable Communications, LLC"
      ]
    },
    {
      "created": "2026-04-03T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=AZ; asn=28787; asn_org=Aztelekom LLC",
      "id": "indicator--50215676-92e4-4594-a825-508f37edaf84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '217.64.24.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T15:05:05.000Z",
      "valid_until": "2026-05-05T15:05:04.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-04-03T14:32:15.190Z",
      "x_nadsec_last_seen": "2026-04-03T14:34:44.112Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "28787"
      ],
      "x_nadsec_orgs": [
        "Aztelekom LLC"
      ]
    },
    {
      "created": "2026-04-03T16:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=131111; asn_org=PT Mora Telematika Indonesia",
      "id": "indicator--df3e6c5d-6f24-42ee-9e4f-c87b663179a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T16:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.160.13.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T16:05:15.000Z",
      "valid_until": "2026-05-05T16:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T15:51:46.719Z",
      "x_nadsec_last_seen": "2026-04-03T15:53:50.936Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "131111"
      ],
      "x_nadsec_orgs": [
        "PT Mora Telematika Indonesia"
      ]
    },
    {
      "created": "2026-04-03T16:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--a9ce9200-e721-4e4c-8371-616cccbcc747",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T16:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '122.238.141.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T16:05:15.000Z",
      "valid_until": "2026-05-05T16:05:13.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-03T15:44:27.422Z",
      "x_nadsec_last_seen": "2026-04-03T15:44:27.534Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-03T16:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--71445c6c-730f-414c-875f-20e5e4cd3044",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T16:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.200.27.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T16:05:15.000Z",
      "valid_until": "2026-05-05T16:05:13.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-03T15:34:53.594Z",
      "x_nadsec_last_seen": "2026-04-22T01:03:02.515Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-03T16:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=26599; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--b5c86279-e9be-4c16-8395-97243ffda095",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T16:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '177.172.179.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T16:05:15.000Z",
      "valid_until": "2026-05-05T16:05:13.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-03T15:34:36.859Z",
      "x_nadsec_last_seen": "2026-04-03T15:34:39.845Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "26599"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-04-03T16:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--a84cb977-515d-4a1d-b277-9f0414c17e0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T16:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.97.19.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T16:05:15.000Z",
      "valid_until": "2026-05-05T16:05:13.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-03T15:07:36.668Z",
      "x_nadsec_last_seen": "2026-04-03T15:07:58.574Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-03T16:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--6635ff1e-5e71-455d-8738-d86bc1a52700",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T16:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.53.234.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T16:05:15.000Z",
      "valid_until": "2026-05-05T16:05:13.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-03T15:15:14.025Z",
      "x_nadsec_last_seen": "2026-04-29T08:03:14.302Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-03T16:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=401626; asn_org=Netiface America, Inc.",
      "id": "indicator--44a3e561-7aff-4861-8d2f-ede61e2e82d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T16:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T16:05:15.000Z",
      "valid_until": "2026-05-05T16:05:13.000Z",
      "x_nadsec_event_count": 21,
      "x_nadsec_first_seen": "2026-04-03T15:26:35.211Z",
      "x_nadsec_last_seen": "2026-04-26T12:18:38.421Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ]
    },
    {
      "created": "2026-04-03T16:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--182707d2-c789-40c8-b64d-ad3a5df02447",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T16:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T16:05:15.000Z",
      "valid_until": "2026-05-05T16:05:13.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-03T15:19:30.198Z",
      "x_nadsec_last_seen": "2026-04-25T14:42:38.329Z",
      "x_nadsec_ports": [
        "81",
        "135",
        "1723"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-03T16:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=NL; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--41eff508-cf9f-46cb-9dc7-999c952d0089",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T16:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '80.82.70.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T16:05:15.000Z",
      "valid_until": "2026-05-05T16:05:13.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-03T15:42:14.683Z",
      "x_nadsec_last_seen": "2026-04-27T07:46:38.616Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-04-03T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--858f6349-b242-41fc-a083-22bcd579e0b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T17:05:11.000Z",
      "valid_until": "2026-05-05T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T16:19:56.015Z",
      "x_nadsec_last_seen": "2026-04-03T16:19:56.015Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-03T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=199404; asn_org=WHG Hosting Services Ltd; user(top)=**",
      "id": "indicator--2f382722-fc1a-4161-9a30-70c097aa433c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.38.85.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T17:05:11.000Z",
      "valid_until": "2026-05-05T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T16:09:21.554Z",
      "x_nadsec_last_seen": "2026-04-03T16:09:21.554Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "199404"
      ],
      "x_nadsec_orgs": [
        "WHG Hosting Services Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-03T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--1dca32d0-c08c-40aa-ac31-c829f08aaf1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T17:05:11.000Z",
      "valid_until": "2026-05-05T17:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-03T16:26:50.166Z",
      "x_nadsec_last_seen": "2026-04-09T16:49:01.709Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-03T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--981781e1-104c-4fe1-b308-c36ed51628f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.105.135.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T17:05:11.000Z",
      "valid_until": "2026-05-05T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T16:11:38.575Z",
      "x_nadsec_last_seen": "2026-04-03T16:11:38.575Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-03T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrord; ports=42; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--519a5c00-ea9f-4af8-b014-da77f9dcc0b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T17:05:11.000Z",
      "valid_until": "2026-05-05T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T17:04:00.004Z",
      "x_nadsec_last_seen": "2026-04-21T19:10:23.139Z",
      "x_nadsec_ports": [
        "42",
        "35289",
        "43971"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-03T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133661; asn_org=Netplus Broadband Services Private Limited",
      "id": "indicator--3616062e-2a2c-4f25-b0e1-bf0185d80ed2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '101.0.45.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T18:05:05.000Z",
      "valid_until": "2026-05-05T18:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T17:42:10.146Z",
      "x_nadsec_last_seen": "2026-04-03T17:42:15.175Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133661"
      ],
      "x_nadsec_orgs": [
        "Netplus Broadband Services Private Limited"
      ]
    },
    {
      "created": "2026-04-03T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--72cf6dd7-60c9-4bc5-be24-3caa301afa36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '125.26.6.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T18:05:05.000Z",
      "valid_until": "2026-05-05T18:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-03T17:23:33.662Z",
      "x_nadsec_last_seen": "2026-04-03T17:30:09.904Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-04-03T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mongod; ports=27017; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b6c58546-be9d-468d-a0a8-1f19b0bd953c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.227.170.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T18:05:05.000Z",
      "valid_until": "2026-05-05T18:05:04.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-04-03T17:39:36.572Z",
      "x_nadsec_last_seen": "2026-04-03T17:42:59.453Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "445",
        "1723",
        "1883",
        "3306",
        "27017",
        "39067"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-03T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--dc0aac8c-b919-4e47-b170-f2cdf1f40097",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.176.84.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T18:05:05.000Z",
      "valid_until": "2026-05-05T18:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T17:28:34.714Z",
      "x_nadsec_last_seen": "2026-04-03T17:30:42.586Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-04-03T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH",
      "id": "indicator--99106802-69bb-4a65-9e57-56529d0ba3d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T18:05:05.000Z",
      "valid_until": "2026-05-05T18:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T17:27:03.154Z",
      "x_nadsec_last_seen": "2026-04-03T17:27:03.154Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "215778"
      ],
      "x_nadsec_orgs": [
        "Alpha Strike Labs GmbH"
      ]
    },
    {
      "created": "2026-04-03T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ZA; asn=11845; asn_org=Vox-Telecom",
      "id": "indicator--cbee7a13-5374-4abd-a216-160696ec89f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.245.254.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T18:05:05.000Z",
      "valid_until": "2026-05-05T18:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T18:00:04.343Z",
      "x_nadsec_last_seen": "2026-04-03T18:02:12.701Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "11845"
      ],
      "x_nadsec_orgs": [
        "Vox-Telecom"
      ]
    },
    {
      "created": "2026-04-03T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--e4ebb833-caa9-4098-b465-4b3d5c012f64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.47.33.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T18:05:05.000Z",
      "valid_until": "2026-05-05T18:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-03T17:47:08.910Z",
      "x_nadsec_last_seen": "2026-04-03T17:54:08.625Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-03T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--9ef7e4c1-b31b-41c8-8139-8e4c3ab95c13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T18:05:05.000Z",
      "valid_until": "2026-05-05T18:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T17:38:25.185Z",
      "x_nadsec_last_seen": "2026-04-03T17:38:25.185Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-03T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--7bd474ad-605f-48d8-a536-7d8c7fe2a861",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.83.151.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T18:05:05.000Z",
      "valid_until": "2026-05-05T18:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T17:51:47.831Z",
      "x_nadsec_last_seen": "2026-04-29T18:14:41.459Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-03T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--9d28318c-d8e0-4ea4-a03b-c350589d2c95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '211.75.38.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T18:05:05.000Z",
      "valid_until": "2026-05-05T18:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T17:33:23.709Z",
      "x_nadsec_last_seen": "2026-04-03T17:33:29.754Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-03T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45458; asn_org=SBN-ISPAWN-ISP and SBN-NIXAWN-NIX",
      "id": "indicator--5882e020-e7a4-4ec8-86d3-a27f8c926621",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '49.229.66.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T18:05:05.000Z",
      "valid_until": "2026-05-05T18:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T17:13:29.299Z",
      "x_nadsec_last_seen": "2026-04-03T17:15:34.092Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45458"
      ],
      "x_nadsec_orgs": [
        "SBN-ISPAWN-ISP and SBN-NIXAWN-NIX"
      ]
    },
    {
      "created": "2026-04-03T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=httpd; ports=81; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--0724f7e5-0c55-4fb9-bcce-28856ef6f5a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T18:05:05.000Z",
      "valid_until": "2026-05-05T18:05:04.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-03T17:22:45.741Z",
      "x_nadsec_last_seen": "2026-04-27T11:33:30.764Z",
      "x_nadsec_ports": [
        "81",
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "httpd",
        "epmapper",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-03T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--fff160e9-0dae-490c-a3df-3f794b4fb3ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T18:05:05.000Z",
      "valid_until": "2026-05-05T18:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T17:37:49.529Z",
      "x_nadsec_last_seen": "2026-04-03T17:37:49.529Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-03T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--07172e1b-3531-4897-9d3b-cd5a56df8c49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.106.148.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T18:05:05.000Z",
      "valid_until": "2026-05-05T18:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-03T17:08:31.653Z",
      "x_nadsec_last_seen": "2026-04-03T17:15:45.427Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-03T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--f4995780-fa98-40f9-b48e-94349a4462a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T18:05:05.000Z",
      "valid_until": "2026-05-05T18:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-03T17:19:19.475Z",
      "x_nadsec_last_seen": "2026-04-14T03:00:41.031Z",
      "x_nadsec_ports": [
        "42",
        "445",
        "36131"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord",
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-03T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--449ea884-64e6-4635-9155-ce17c1651729",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T18:05:05.000Z",
      "valid_until": "2026-05-05T18:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-03T17:08:50.419Z",
      "x_nadsec_last_seen": "2026-04-05T12:06:01.872Z",
      "x_nadsec_ports": [
        "81",
        "445"
      ],
      "x_nadsec_services": [
        "httpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-03T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--2dda8d55-5f42-498f-a54c-4317718137d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T18:05:05.000Z",
      "valid_until": "2026-05-05T18:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T17:54:21.400Z",
      "x_nadsec_last_seen": "2026-04-03T17:54:21.400Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-03T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=23923; asn_org=Agni Systems Limited",
      "id": "indicator--5588bdf0-9910-4ee6-8320-a8198a4f3741",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '116.68.205.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T19:05:11.000Z",
      "valid_until": "2026-05-05T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T18:54:14.090Z",
      "x_nadsec_last_seen": "2026-04-03T18:56:18.910Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "23923"
      ],
      "x_nadsec_orgs": [
        "Agni Systems Limited"
      ]
    },
    {
      "created": "2026-04-03T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--2d2e2411-53c3-4561-9da1-7d162757677a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.202.114.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T19:05:11.000Z",
      "valid_until": "2026-05-05T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-03T18:19:18.941Z",
      "x_nadsec_last_seen": "2026-04-03T18:19:29.117Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-03T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=14; services=pptpd; ports=1723; cc=HK; asn=23470; asn_org=ReliableSite.Net LLC",
      "id": "indicator--e4854edc-2e95-4df7-bd47-96d2ddc5bd44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.243.5.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T19:05:11.000Z",
      "valid_until": "2026-05-05T19:05:09.000Z",
      "x_nadsec_event_count": 31,
      "x_nadsec_first_seen": "2026-04-03T18:28:13.709Z",
      "x_nadsec_last_seen": "2026-04-12T08:48:56.992Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "23470"
      ],
      "x_nadsec_orgs": [
        "ReliableSite.Net LLC"
      ]
    },
    {
      "created": "2026-04-03T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b6cad070-d43e-49a5-b615-646c2bdc79aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T19:05:11.000Z",
      "valid_until": "2026-05-05T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-03T18:14:51.644Z",
      "x_nadsec_last_seen": "2026-04-10T04:17:05.010Z",
      "x_nadsec_ports": [
        "81",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-03T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--ed0e4e90-ba02-428c-95f4-ec50312d7079",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T19:05:11.000Z",
      "valid_until": "2026-05-05T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-03T18:43:38.037Z",
      "x_nadsec_last_seen": "2026-04-22T17:02:48.907Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-03T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=RU; asn=8359; asn_org=MTS PJSC",
      "id": "indicator--933a3e65-41fa-44a6-ab81-608aa9764f7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.139.249.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T19:05:11.000Z",
      "valid_until": "2026-05-05T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T18:09:29.830Z",
      "x_nadsec_last_seen": "2026-04-03T18:09:29.830Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8359"
      ],
      "x_nadsec_orgs": [
        "MTS PJSC"
      ]
    },
    {
      "created": "2026-04-03T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--dbb96c35-2d30-4a19-bac2-5443fb07ad4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.161.22.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T20:05:10.000Z",
      "valid_until": "2026-05-05T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T19:51:25.401Z",
      "x_nadsec_last_seen": "2026-04-03T19:53:30.154Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-03T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mqttd; ports=1883; cc=NG; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--662de756-dc76-464e-9dc6-362a2ff92871",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.11.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T20:05:10.000Z",
      "valid_until": "2026-05-05T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T19:21:46.087Z",
      "x_nadsec_last_seen": "2026-04-03T19:22:16.245Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-03T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--6536f679-c0c3-498d-a66e-6cef25f36e65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '175.107.200.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T20:05:10.000Z",
      "valid_until": "2026-05-05T20:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-03T19:55:37.472Z",
      "x_nadsec_last_seen": "2026-04-03T20:02:46.433Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ]
    },
    {
      "created": "2026-04-03T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ES; asn=200845; asn_org=Avatel Telecom, SA",
      "id": "indicator--42a6f29d-9b2e-4824-b167-9c49575c78f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.126.235.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T20:05:10.000Z",
      "valid_until": "2026-05-05T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T20:01:50.216Z",
      "x_nadsec_last_seen": "2026-04-03T20:03:56.369Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "200845"
      ],
      "x_nadsec_orgs": [
        "Avatel Telecom, SA"
      ]
    },
    {
      "created": "2026-04-03T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=25369; asn_org=Hydra Communications Ltd",
      "id": "indicator--2d3f45df-a61e-4fa2-8fa8-e8960dcaab1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.88.98.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T20:05:10.000Z",
      "valid_until": "2026-05-05T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-03T19:44:41.818Z",
      "x_nadsec_last_seen": "2026-04-04T23:25:01.801Z",
      "x_nadsec_ports": [
        "21",
        "81"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "25369"
      ],
      "x_nadsec_orgs": [
        "Hydra Communications Ltd"
      ]
    },
    {
      "created": "2026-04-03T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--256bffd8-3fb7-4009-bedc-d6124af85816",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T20:05:10.000Z",
      "valid_until": "2026-05-05T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T20:03:43.905Z",
      "x_nadsec_last_seen": "2026-04-03T20:03:43.905Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-03T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--11f08629-7428-4caa-95cf-5258a03d9ecb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T20:05:10.000Z",
      "valid_until": "2026-05-05T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T19:15:36.842Z",
      "x_nadsec_last_seen": "2026-04-03T19:15:36.842Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-03T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--cc43a6bf-32f9-4eeb-b776-d860b2b1ca76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.76.250.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T20:05:10.000Z",
      "valid_until": "2026-05-05T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T19:28:27.400Z",
      "x_nadsec_last_seen": "2026-04-03T19:28:27.400Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-03T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=131429; asn_org=MOBIFONE Corporation",
      "id": "indicator--c0dc5d02-e683-4250-a88e-0244c0a9ebd3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.156.4.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T21:05:05.000Z",
      "valid_until": "2026-05-05T21:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-03T20:10:15.310Z",
      "x_nadsec_last_seen": "2026-04-03T20:14:50.005Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "131429"
      ],
      "x_nadsec_orgs": [
        "MOBIFONE Corporation"
      ]
    },
    {
      "created": "2026-04-03T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4e46b47b-f645-4049-b265-e1b472786020",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.237.124.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T21:05:05.000Z",
      "valid_until": "2026-05-05T21:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T20:25:00.217Z",
      "x_nadsec_last_seen": "2026-04-03T20:25:00.217Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-03T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=NL; asn=60223; asn_org=Netiface Limited",
      "id": "indicator--45f7dc4b-c52e-4fc8-9a8e-b524ff66b782",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.242.3.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T21:05:05.000Z",
      "valid_until": "2026-05-05T21:05:04.000Z",
      "x_nadsec_event_count": 20,
      "x_nadsec_first_seen": "2026-04-03T20:55:37.955Z",
      "x_nadsec_last_seen": "2026-04-28T05:07:20.600Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "60223"
      ],
      "x_nadsec_orgs": [
        "Netiface Limited"
      ]
    },
    {
      "created": "2026-04-03T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--f12481a3-e44f-4f14-9363-d556a890660c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T21:05:05.000Z",
      "valid_until": "2026-05-05T21:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T20:13:00.012Z",
      "x_nadsec_last_seen": "2026-04-03T20:13:00.012Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-03T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a4baac67-01c2-4b1d-bceb-d351d1be31fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T21:05:05.000Z",
      "valid_until": "2026-05-05T21:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-03T20:40:55.020Z",
      "x_nadsec_last_seen": "2026-04-03T20:40:56.074Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-03T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--2bdea174-07ce-455b-a65b-9f1d85e28456",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.64.104.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T21:05:05.000Z",
      "valid_until": "2026-05-05T21:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T20:51:55.889Z",
      "x_nadsec_last_seen": "2026-04-03T20:51:55.889Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-03T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--10ef1baa-ee80-4730-88d2-dd78c1087b43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '39.35.226.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T21:05:05.000Z",
      "valid_until": "2026-05-05T21:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-03T20:31:58.189Z",
      "x_nadsec_last_seen": "2026-04-03T20:32:35.968Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-04-03T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=PK; asn=205759; asn_org=Ghosty Networks LLC",
      "id": "indicator--b361146d-529f-4b72-b6d5-1aa8c078a49c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '43.228.157.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T21:05:05.000Z",
      "valid_until": "2026-05-05T21:05:04.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-04-03T20:55:44.247Z",
      "x_nadsec_last_seen": "2026-04-30T12:02:06.539Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "205759"
      ],
      "x_nadsec_orgs": [
        "Ghosty Networks LLC"
      ]
    },
    {
      "created": "2026-04-03T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=NL; asn=205759; asn_org=Ghosty Networks LLC; user(top)=r**t",
      "id": "indicator--282d472d-7081-4105-9ed9-fdbb73ec645b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.151.182.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T21:05:05.000Z",
      "valid_until": "2026-05-05T21:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T21:02:29.640Z",
      "x_nadsec_last_seen": "2026-04-03T21:02:29.640Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "205759"
      ],
      "x_nadsec_orgs": [
        "Ghosty Networks LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-03T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TH; asn=17552; asn_org=True Online; user(top)=**",
      "id": "indicator--fbce2876-cb3d-4c63-a681-88682a0987e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '110.171.111.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T22:05:10.000Z",
      "valid_until": "2026-05-05T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T21:24:58.570Z",
      "x_nadsec_last_seen": "2026-04-03T21:24:58.570Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "17552"
      ],
      "x_nadsec_orgs": [
        "True Online"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-03T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=JP; asn=17676; asn_org=SoftBank Corp.",
      "id": "indicator--f90dc26b-99b0-4335-9eaa-e6367028646b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.103.117.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T22:05:10.000Z",
      "valid_until": "2026-05-05T22:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-03T21:09:37.231Z",
      "x_nadsec_last_seen": "2026-04-03T21:17:07.077Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "17676"
      ],
      "x_nadsec_orgs": [
        "SoftBank Corp."
      ]
    },
    {
      "created": "2026-04-03T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--da83b464-2a67-41db-bfb0-76adb1027c6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '125.234.239.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T22:05:10.000Z",
      "valid_until": "2026-05-05T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-03T21:06:36.853Z",
      "x_nadsec_last_seen": "2026-04-03T21:06:37.027Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-03T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--5758bee0-4d12-424d-995b-f537f8807471",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.241.237.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T22:05:10.000Z",
      "valid_until": "2026-05-05T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-03T21:08:40.808Z",
      "x_nadsec_last_seen": "2026-04-03T21:08:41.569Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-03T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--cdc73429-8c8f-488e-9908-16f0296b0574",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.241.103.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T22:05:10.000Z",
      "valid_until": "2026-05-05T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T21:13:25.420Z",
      "x_nadsec_last_seen": "2026-04-03T21:15:32.415Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-04-03T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--c5b2de4e-b12f-46a8-a34d-f5a5cc07cc4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.236.61.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T22:05:10.000Z",
      "valid_until": "2026-05-05T22:05:09.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-04-03T21:39:36.457Z",
      "x_nadsec_last_seen": "2026-04-17T19:35:08.544Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-04-03T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=UA; asn=13188; asn_org=Content Delivery Network Ltd; user(top)=**",
      "id": "indicator--4c06cf14-8da9-4781-a14e-b2c2b98cc2e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.151.142.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T22:05:10.000Z",
      "valid_until": "2026-05-05T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T21:34:33.090Z",
      "x_nadsec_last_seen": "2026-04-14T10:00:10.340Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "13188"
      ],
      "x_nadsec_orgs": [
        "Content Delivery Network Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-03T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--63dced73-9b9f-4b2e-80ba-bf63ddcd8b31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.168.121.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T22:05:10.000Z",
      "valid_until": "2026-05-05T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-03T21:15:59.681Z",
      "x_nadsec_last_seen": "2026-04-03T21:16:09.824Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-03T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--919b61de-7bd9-477f-be2e-df1b1d77f8b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T23:05:10.000Z",
      "valid_until": "2026-05-05T23:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-03T22:56:13.654Z",
      "x_nadsec_last_seen": "2026-04-03T22:56:43.655Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-03T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MX; asn=8151; asn_org=UNINET; user(top)=**",
      "id": "indicator--37c0f460-42fc-4887-89c4-7e37d61343ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '187.201.31.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T23:05:10.000Z",
      "valid_until": "2026-05-05T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T22:30:21.697Z",
      "x_nadsec_last_seen": "2026-04-03T22:30:21.697Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-03T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4eb59244-ad7b-4276-b9f7-1ffaee75e182",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.40.218.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T23:05:10.000Z",
      "valid_until": "2026-05-05T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T22:22:25.771Z",
      "x_nadsec_last_seen": "2026-04-24T04:37:06.503Z",
      "x_nadsec_ports": [
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-03T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f41b67e4-0775-4284-97c8-dd16a90826c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.124.174.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T23:05:10.000Z",
      "valid_until": "2026-05-05T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T22:18:30.094Z",
      "x_nadsec_last_seen": "2026-04-03T22:18:30.094Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-03T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=401626; asn_org=Netiface America, Inc.",
      "id": "indicator--192477f9-56e9-4e8b-a2c1-f79a4cec0730",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T23:05:10.000Z",
      "valid_until": "2026-05-05T23:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-04-03T22:37:07.627Z",
      "x_nadsec_last_seen": "2026-04-30T16:56:19.149Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ]
    },
    {
      "created": "2026-04-04T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--f5eaa587-b392-4838-a933-d19cbbfc4224",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.162.146.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T00:05:10.000Z",
      "valid_until": "2026-05-06T00:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-03T23:26:39.627Z",
      "x_nadsec_last_seen": "2026-04-03T23:32:53.420Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-04-04T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=36352; asn_org=HostPapa",
      "id": "indicator--8fcd1c86-f770-4ca3-bbcf-f922b07bb371",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '107.172.35.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T00:05:10.000Z",
      "valid_until": "2026-05-06T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T23:48:57.398Z",
      "x_nadsec_last_seen": "2026-04-03T23:48:57.398Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "36352"
      ],
      "x_nadsec_orgs": [
        "HostPapa"
      ]
    },
    {
      "created": "2026-04-04T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NP; asn=23752; asn_org=Nepal Telecommunications Corporation, Internet Services",
      "id": "indicator--9beda0f2-2ad9-4c47-81ff-c71f16e280d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.199.228.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T00:05:10.000Z",
      "valid_until": "2026-05-06T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-03T23:13:42.948Z",
      "x_nadsec_last_seen": "2026-04-03T23:15:47.881Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NP"
      ],
      "x_nadsec_asns": [
        "23752"
      ],
      "x_nadsec_orgs": [
        "Nepal Telecommunications Corporation, Internet Services"
      ]
    },
    {
      "created": "2026-04-04T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=DE; asn=25369; asn_org=Hydra Communications Ltd",
      "id": "indicator--7a163de1-78da-4600-93de-af279289e45c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.88.98.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T00:05:10.000Z",
      "valid_until": "2026-05-06T00:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-03T23:28:50.797Z",
      "x_nadsec_last_seen": "2026-04-04T23:25:02.447Z",
      "x_nadsec_ports": [
        "81",
        "445"
      ],
      "x_nadsec_services": [
        "httpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "25369"
      ],
      "x_nadsec_orgs": [
        "Hydra Communications Ltd"
      ]
    },
    {
      "created": "2026-04-04T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=DE; asn=25369; asn_org=Hydra Communications Ltd",
      "id": "indicator--2b851cbb-b0bf-427e-8353-9b2394a8c195",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.88.98.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T00:05:10.000Z",
      "valid_until": "2026-05-06T00:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-03T23:28:30.879Z",
      "x_nadsec_last_seen": "2026-04-04T23:20:10.290Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "25369"
      ],
      "x_nadsec_orgs": [
        "Hydra Communications Ltd"
      ]
    },
    {
      "created": "2026-04-04T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=DE; asn=25369; asn_org=Hydra Communications Ltd",
      "id": "indicator--34b29d51-a979-4145-a2db-122b2f80bfd3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.88.98.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T00:05:10.000Z",
      "valid_until": "2026-05-06T00:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-03T23:28:37.016Z",
      "x_nadsec_last_seen": "2026-04-04T23:25:13.134Z",
      "x_nadsec_ports": [
        "81",
        "445"
      ],
      "x_nadsec_services": [
        "httpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "25369"
      ],
      "x_nadsec_orgs": [
        "Hydra Communications Ltd"
      ]
    },
    {
      "created": "2026-04-04T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=DE; asn=25369; asn_org=Hydra Communications Ltd",
      "id": "indicator--44a0728d-9343-4827-ad21-f520143763b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.88.98.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T00:05:10.000Z",
      "valid_until": "2026-05-06T00:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-03T23:28:31.634Z",
      "x_nadsec_last_seen": "2026-04-04T23:25:18.507Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "25369"
      ],
      "x_nadsec_orgs": [
        "Hydra Communications Ltd"
      ]
    },
    {
      "created": "2026-04-04T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--7168f0c5-dbcd-48b8-ab9d-1ba929024b14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.150.193.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T00:05:10.000Z",
      "valid_until": "2026-05-06T00:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-03T23:46:22.236Z",
      "x_nadsec_last_seen": "2026-04-08T14:05:28.769Z",
      "x_nadsec_ports": [
        "445",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-04T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=PK; asn=59257; asn_org=CMPak Limited",
      "id": "indicator--ca0de576-e949-4dec-aca9-5fbff5d312e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '223.123.72.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T00:05:10.000Z",
      "valid_until": "2026-05-06T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-03T23:12:21.233Z",
      "x_nadsec_last_seen": "2026-04-03T23:12:21.233Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "59257"
      ],
      "x_nadsec_orgs": [
        "CMPak Limited"
      ]
    },
    {
      "created": "2026-04-04T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a89a0a3e-4286-4200-9b8d-f529b5b10e70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.124.173.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T00:05:10.000Z",
      "valid_until": "2026-05-06T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-03T23:36:18.726Z",
      "x_nadsec_last_seen": "2026-04-03T23:36:19.044Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-04T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--341f6032-645c-460f-984a-2af3f4ae9c3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '78.172.196.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T00:05:10.000Z",
      "valid_until": "2026-05-06T00:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-04T00:03:24.715Z",
      "x_nadsec_last_seen": "2026-04-04T00:10:48.079Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-04T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--afb74f10-c6e0-47f4-a06d-029b39c70eaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '100.55.66.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T01:05:10.000Z",
      "valid_until": "2026-05-06T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T01:01:06.231Z",
      "x_nadsec_last_seen": "2026-04-04T01:01:06.231Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-04T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--431b9185-ffd1-4c75-b373-0283d6425511",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.191.38.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T01:05:10.000Z",
      "valid_until": "2026-05-06T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T00:39:38.670Z",
      "x_nadsec_last_seen": "2026-04-04T00:39:38.670Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-04T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=135175; asn_org=Facts Online Pvt Ltd; user(top)=**",
      "id": "indicator--9115b390-35cc-40a9-b021-acdf738f363c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.61.77.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T01:05:10.000Z",
      "valid_until": "2026-05-06T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T00:09:55.072Z",
      "x_nadsec_last_seen": "2026-04-04T00:09:55.072Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135175"
      ],
      "x_nadsec_orgs": [
        "Facts Online Pvt Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-04T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--3d3252e4-26e8-4999-a79c-8eeae2d7e5d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.161.81.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T02:05:10.000Z",
      "valid_until": "2026-05-06T02:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-04T01:51:42.696Z",
      "x_nadsec_last_seen": "2026-04-04T01:52:11.640Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-04T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=138089; asn_org=PT.Global Media Data Prima",
      "id": "indicator--d515530a-4f77-4c44-a49d-f6b8ccb7d5b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.192.48.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T02:05:10.000Z",
      "valid_until": "2026-05-06T02:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T01:41:42.116Z",
      "x_nadsec_last_seen": "2026-04-04T01:43:46.914Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "138089"
      ],
      "x_nadsec_orgs": [
        "PT.Global Media Data Prima"
      ]
    },
    {
      "created": "2026-04-04T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--5780fc38-dc4d-4f74-80df-c3e574767fdd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.237.172.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T02:05:10.000Z",
      "valid_until": "2026-05-06T02:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-04T01:36:04.888Z",
      "x_nadsec_last_seen": "2026-04-04T02:49:23.606Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-04-04T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--10746048-2b09-43db-bdd6-8e422290ba77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '213.74.115.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T02:05:10.000Z",
      "valid_until": "2026-05-06T02:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T01:57:17.637Z",
      "x_nadsec_last_seen": "2026-04-04T01:59:24.010Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-04-04T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--966b8d55-4bcd-4865-83dc-7e5a9f7e93d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.62.172.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T02:05:10.000Z",
      "valid_until": "2026-05-06T02:05:08.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-04T01:13:54.537Z",
      "x_nadsec_last_seen": "2026-04-25T04:36:42.683Z",
      "x_nadsec_ports": [
        "21",
        "3306",
        "445",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld",
        "mongod",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t",
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "",
        "a********@"
      ]
    },
    {
      "created": "2026-04-04T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=30848; asn_org=UNIDATA S.p.A.",
      "id": "indicator--72de38f1-167c-4d80-af5f-b0cd4133096f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '83.217.182.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T02:05:10.000Z",
      "valid_until": "2026-05-06T02:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T01:40:02.369Z",
      "x_nadsec_last_seen": "2026-04-04T01:42:09.030Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "30848"
      ],
      "x_nadsec_orgs": [
        "UNIDATA S.p.A."
      ]
    },
    {
      "created": "2026-04-04T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--943d2f3e-b39c-4584-a762-e9622fc4fe9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T03:05:10.000Z",
      "valid_until": "2026-05-06T03:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-04T02:20:58.196Z",
      "x_nadsec_last_seen": "2026-04-04T02:21:08.200Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-04T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CL; asn=27651; asn_org=ENTEL CHILE S.A.",
      "id": "indicator--f67ffd2c-ffcb-4c41-bc03-aaea1964effc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '181.43.104.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T03:05:10.000Z",
      "valid_until": "2026-05-06T03:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-04T02:23:00.884Z",
      "x_nadsec_last_seen": "2026-04-04T02:23:00.960Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "27651"
      ],
      "x_nadsec_orgs": [
        "ENTEL CHILE S.A."
      ]
    },
    {
      "created": "2026-04-04T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=25341; asn_org=Nauchno proizvodstvennaya Firma Raspredelennaya Obrabotka Informacii LLC",
      "id": "indicator--a03b46d8-6b60-4b2b-b15a-df861958e97b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.75.180.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T03:05:10.000Z",
      "valid_until": "2026-05-06T03:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-04T02:37:47.106Z",
      "x_nadsec_last_seen": "2026-04-04T02:44:49.109Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25341"
      ],
      "x_nadsec_orgs": [
        "Nauchno proizvodstvennaya Firma Raspredelennaya Obrabotka Informacii LLC"
      ]
    },
    {
      "created": "2026-04-04T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--06c9b94e-77c8-437e-b143-7d26f897d259",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.81.46.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T03:05:10.000Z",
      "valid_until": "2026-05-06T03:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T02:30:57.000Z",
      "x_nadsec_last_seen": "2026-04-04T02:30:57.000Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-04T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=137125; asn_org=Netsat Communications Private Limited",
      "id": "indicator--a80181ed-e9dc-413b-a75a-fe51364656dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '202.137.212.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T03:05:10.000Z",
      "valid_until": "2026-05-06T03:05:08.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-04-04T03:04:39.576Z",
      "x_nadsec_last_seen": "2026-04-04T04:13:57.819Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "137125"
      ],
      "x_nadsec_orgs": [
        "Netsat Communications Private Limited"
      ]
    },
    {
      "created": "2026-04-04T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--21f842af-b3a3-434a-b9b0-0afb66a123bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T03:05:10.000Z",
      "valid_until": "2026-05-06T03:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-04T02:08:31.584Z",
      "x_nadsec_last_seen": "2026-04-20T00:37:29.988Z",
      "x_nadsec_ports": [
        "135",
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-04T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=401626; asn_org=Netiface America, Inc.",
      "id": "indicator--a15541db-e961-458e-aba1-b348be38c50e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T03:05:10.000Z",
      "valid_until": "2026-05-06T03:05:08.000Z",
      "x_nadsec_event_count": 24,
      "x_nadsec_first_seen": "2026-04-04T02:54:46.005Z",
      "x_nadsec_last_seen": "2026-04-30T20:15:47.937Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ]
    },
    {
      "created": "2026-04-04T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--f28d4ab1-d795-4e5d-8ca6-109f5023f2e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '88.204.141.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T03:05:10.000Z",
      "valid_until": "2026-05-06T03:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-04T02:17:38.714Z",
      "x_nadsec_last_seen": "2026-04-04T02:24:44.986Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-04-04T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--5ffae159-67ed-4a2d-899e-bdb7f1050bb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '109.105.209.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T04:05:09.000Z",
      "valid_until": "2026-05-06T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T03:47:35.961Z",
      "x_nadsec_last_seen": "2026-04-04T03:47:35.961Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-04-04T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--2a01da51-d2ff-4704-8cd8-b8820cbeb9fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T04:05:09.000Z",
      "valid_until": "2026-05-06T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T03:33:41.868Z",
      "x_nadsec_last_seen": "2026-04-04T03:33:41.868Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-04T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--c842da96-ab42-494f-97db-0b46715a7e2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T04:05:09.000Z",
      "valid_until": "2026-05-06T04:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T03:21:10.051Z",
      "x_nadsec_last_seen": "2026-04-27T12:10:51.857Z",
      "x_nadsec_ports": [
        "1883",
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-04T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8d6cb90a-561e-4dad-873a-6b7ef768d103",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T04:05:09.000Z",
      "valid_until": "2026-05-06T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T03:34:10.782Z",
      "x_nadsec_last_seen": "2026-04-04T03:34:10.782Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-04T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=40021; asn_org=Contabo Inc.; user(top)=**",
      "id": "indicator--d5b9f5df-782f-426f-a587-077f98ae3b3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.94.106.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T04:05:09.000Z",
      "valid_until": "2026-05-06T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T03:14:22.966Z",
      "x_nadsec_last_seen": "2026-04-04T03:14:22.966Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "40021"
      ],
      "x_nadsec_orgs": [
        "Contabo Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-04T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LT; asn=8764; asn_org=Telia Lietuva, AB",
      "id": "indicator--fafc868e-d0b3-4b51-85b7-ac1c433bc84e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '88.118.111.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T04:05:09.000Z",
      "valid_until": "2026-05-06T04:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T03:33:17.945Z",
      "x_nadsec_last_seen": "2026-04-04T03:35:25.027Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LT"
      ],
      "x_nadsec_asns": [
        "8764"
      ],
      "x_nadsec_orgs": [
        "Telia Lietuva, AB"
      ]
    },
    {
      "created": "2026-04-04T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--873c4dc2-d739-48cc-accb-186d318cf5a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.165.126.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T05:05:10.000Z",
      "valid_until": "2026-05-06T05:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T04:46:45.286Z",
      "x_nadsec_last_seen": "2026-04-04T04:48:51.405Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-04T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--dfb7b648-32bd-4dfa-80cf-ca98480f5822",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '100.28.191.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T05:05:10.000Z",
      "valid_until": "2026-05-06T05:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T04:59:37.418Z",
      "x_nadsec_last_seen": "2026-04-04T04:59:37.418Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-04T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=151690; asn_org=FAB FIVE NETWORK PRIVATE LIMITED",
      "id": "indicator--d28a106f-d97d-4fba-980b-945264a35911",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.162.74.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T05:05:10.000Z",
      "valid_until": "2026-05-06T05:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-04T04:48:53.375Z",
      "x_nadsec_last_seen": "2026-04-04T04:56:00.025Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "151690"
      ],
      "x_nadsec_orgs": [
        "FAB FIVE NETWORK PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-04-04T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrord; ports=42; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--40efb009-4a71-4557-8a76-e63d20940b3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '162.216.150.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T05:05:10.000Z",
      "valid_until": "2026-05-06T05:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-04T04:58:07.529Z",
      "x_nadsec_last_seen": "2026-04-04T04:58:07.531Z",
      "x_nadsec_ports": [
        "42",
        "44909"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-04T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e70e019e-4043-4583-adce-17e3c0de3f9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T05:05:10.000Z",
      "valid_until": "2026-05-06T05:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-04T04:15:09.377Z",
      "x_nadsec_last_seen": "2026-04-15T07:32:10.809Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-04T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--87910225-e211-43d6-8e0f-36badf0a456e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.143.162.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T05:05:10.000Z",
      "valid_until": "2026-05-06T05:05:08.000Z",
      "x_nadsec_event_count": 67,
      "x_nadsec_first_seen": "2026-04-01T21:45:15.855Z",
      "x_nadsec_last_seen": "2026-04-29T20:09:47.733Z",
      "x_nadsec_ports": [
        "27017",
        "445",
        "81",
        "1433",
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "mongod",
        "smbd",
        "httpd",
        "mssqld",
        "pptpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-04T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=AZ; asn=28787; asn_org=Aztelekom LLC; user(top)=**",
      "id": "indicator--8974ae26-4c27-4b9c-9ba1-812ae390d665",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '81.17.88.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T05:05:10.000Z",
      "valid_until": "2026-05-06T05:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T04:39:51.317Z",
      "x_nadsec_last_seen": "2026-04-04T04:39:51.317Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "28787"
      ],
      "x_nadsec_orgs": [
        "Aztelekom LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-04T06:05:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--256f4ba8-786f-43dc-b140-fe498a6f2c68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T06:05:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.241.229.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T06:05:51.000Z",
      "valid_until": "2026-05-06T06:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-04T05:13:33.638Z",
      "x_nadsec_last_seen": "2026-04-30T19:17:21.693Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-04T06:05:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--453c1c77-0d37-4a27-89a2-933db385c6a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T06:05:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.169.104.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T06:05:51.000Z",
      "valid_until": "2026-05-06T06:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-04T05:38:41.042Z",
      "x_nadsec_last_seen": "2026-04-04T05:38:51.327Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-04T06:05:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=11888; asn_org=Television Internacional, S.A. de C.V.",
      "id": "indicator--1a321d9e-b534-484f-b4d2-b441185a7333",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T06:05:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '201.175.104.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T06:05:51.000Z",
      "valid_until": "2026-05-06T06:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T05:16:52.289Z",
      "x_nadsec_last_seen": "2026-04-04T05:18:58.148Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "11888"
      ],
      "x_nadsec_orgs": [
        "Television Internacional, S.A. de C.V."
      ]
    },
    {
      "created": "2026-04-04T06:05:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--7ea63083-fe67-4f80-9372-6a0f6fb74dcf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T06:05:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.77.191.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T06:05:51.000Z",
      "valid_until": "2026-05-06T06:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-04T05:05:43.482Z",
      "x_nadsec_last_seen": "2026-04-15T13:16:45.503Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-04T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--d8a0b7af-6a92-4c65-ace7-98831d6df8dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.205.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T07:05:10.000Z",
      "valid_until": "2026-05-06T07:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-04T07:00:22.366Z",
      "x_nadsec_last_seen": "2026-04-04T07:00:33.865Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a*******s"
      ]
    },
    {
      "created": "2026-04-04T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--6bcfb678-d402-4a1d-a2b6-b44170404cfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.233.42.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T07:05:10.000Z",
      "valid_until": "2026-05-06T07:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T06:44:23.408Z",
      "x_nadsec_last_seen": "2026-04-06T07:16:16.884Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s",
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        "",
        "a********@"
      ]
    },
    {
      "created": "2026-04-04T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--76561da7-cb95-4596-8922-af3d6276befa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.33.80.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T07:05:10.000Z",
      "valid_until": "2026-05-06T07:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-04T07:02:34.222Z",
      "x_nadsec_last_seen": "2026-04-04T07:02:34.617Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-04T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--dee71225-569a-48d1-8cd7-636420ff3ccf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T07:05:10.000Z",
      "valid_until": "2026-05-06T07:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T06:32:07.808Z",
      "x_nadsec_last_seen": "2026-04-04T06:32:07.808Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-04T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--08cd7a19-8624-4105-88ce-a6e1368f12ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T07:05:10.000Z",
      "valid_until": "2026-05-06T07:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-04T06:39:38.284Z",
      "x_nadsec_last_seen": "2026-04-12T23:32:40.468Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-04T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--4e1b9248-bddb-4114-a15e-1992677cfffa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '81.10.22.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T07:05:10.000Z",
      "valid_until": "2026-05-06T07:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T06:30:58.518Z",
      "x_nadsec_last_seen": "2026-04-04T06:33:04.933Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-04T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=202412; asn_org=Omegatech LTD",
      "id": "indicator--653ab9d8-7323-4360-b204-b60dd9acdd26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.92.243.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T07:05:10.000Z",
      "valid_until": "2026-05-06T07:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T06:58:47.923Z",
      "x_nadsec_last_seen": "2026-04-04T06:58:47.923Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ]
    },
    {
      "created": "2026-04-04T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--fb739250-0b7b-446a-a1b1-726115d7d7ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.53.85.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:05:10.000Z",
      "valid_until": "2026-05-06T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T07:19:28.068Z",
      "x_nadsec_last_seen": "2026-04-04T07:21:33.026Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-04-04T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133692; asn_org=Fastnet Communication Pvt. Ltd.",
      "id": "indicator--2aa17a41-94e1-4d0c-813b-ad95f1e6a658",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.47.218.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:05:10.000Z",
      "valid_until": "2026-05-06T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T07:44:08.003Z",
      "x_nadsec_last_seen": "2026-04-04T07:46:13.085Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133692"
      ],
      "x_nadsec_orgs": [
        "Fastnet Communication Pvt. Ltd."
      ]
    },
    {
      "created": "2026-04-04T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=18881; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--57f0800f-810a-4829-8448-3257052b98f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '179.178.49.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:05:10.000Z",
      "valid_until": "2026-05-06T08:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-04T07:47:52.995Z",
      "x_nadsec_last_seen": "2026-04-08T20:17:02.018Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "18881"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-04-04T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BD; asn=24323; asn_org=aamra networks limited",
      "id": "indicator--144ad206-f5f0-4dd5-8029-7c5a2b8f111e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.160.116.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:05:10.000Z",
      "valid_until": "2026-05-06T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-04T07:21:23.709Z",
      "x_nadsec_last_seen": "2026-04-04T07:28:09.464Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "24323"
      ],
      "x_nadsec_orgs": [
        "aamra networks limited"
      ]
    },
    {
      "created": "2026-04-04T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--a4783fb3-c137-4404-82bd-bd67c6780023",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:05:10.000Z",
      "valid_until": "2026-05-06T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-04T07:47:51.918Z",
      "x_nadsec_last_seen": "2026-04-29T15:15:05.201Z",
      "x_nadsec_ports": [
        "3306",
        "81",
        "1883"
      ],
      "x_nadsec_services": [
        "mysqld",
        "httpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-04T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--f1381559-e52b-4710-b0c5-d53912475ca6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:05:10.000Z",
      "valid_until": "2026-05-06T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-04T07:34:04.895Z",
      "x_nadsec_last_seen": "2026-04-24T06:10:00.761Z",
      "x_nadsec_ports": [
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-04T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=3269; asn_org=TIM",
      "id": "indicator--28d65b6d-52b8-4d3e-b92e-f01f5cac77d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.85.241.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:05:10.000Z",
      "valid_until": "2026-05-06T08:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-04-04T07:22:00.054Z",
      "x_nadsec_last_seen": "2026-04-25T19:27:40.555Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "3269"
      ],
      "x_nadsec_orgs": [
        "TIM"
      ]
    },
    {
      "created": "2026-04-04T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--6ee978c9-b3da-4131-a807-a31bba0889da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '122.166.228.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T09:05:11.000Z",
      "valid_until": "2026-05-06T09:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-04T08:39:20.517Z",
      "x_nadsec_last_seen": "2026-04-04T08:39:21.489Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-04-04T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--fe58d46a-1e64-4590-a8cf-2e74703b2a31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T09:05:11.000Z",
      "valid_until": "2026-05-06T09:05:10.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-04-04T08:39:38.663Z",
      "x_nadsec_last_seen": "2026-04-21T16:17:58.490Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-04-04T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--2af28387-1132-430d-bc4c-929f1183c400",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.163.2.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T09:05:11.000Z",
      "valid_until": "2026-05-06T09:05:10.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-04T08:14:23.936Z",
      "x_nadsec_last_seen": "2026-04-08T21:55:10.439Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-04T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--6ee237cb-f224-4615-8fb5-43b4a44cb716",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '59.96.107.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T09:05:11.000Z",
      "valid_until": "2026-05-06T09:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-04T08:46:24.609Z",
      "x_nadsec_last_seen": "2026-04-04T08:53:05.469Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-04-04T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IE; asn=6830; asn_org=Liberty Global Europe Holding B.V.",
      "id": "indicator--765bf693-119f-4900-89ac-e6ff860f25d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '89.100.110.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T09:05:11.000Z",
      "valid_until": "2026-05-06T09:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T08:23:45.776Z",
      "x_nadsec_last_seen": "2026-04-04T08:23:52.027Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IE"
      ],
      "x_nadsec_asns": [
        "6830"
      ],
      "x_nadsec_orgs": [
        "Liberty Global Europe Holding B.V."
      ]
    },
    {
      "created": "2026-04-04T10:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--810406a4-a521-4d26-99c3-15847a9bc5fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T10:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.163.202.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T10:05:09.000Z",
      "valid_until": "2026-05-06T10:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T09:39:00.942Z",
      "x_nadsec_last_seen": "2026-04-04T09:41:05.724Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-04T10:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--0ccc3d75-22ca-46a9-b9a5-d73239b301a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T10:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.183.241.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T10:05:09.000Z",
      "valid_until": "2026-05-06T10:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T09:17:45.680Z",
      "x_nadsec_last_seen": "2026-04-04T09:19:50.465Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-04T10:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--9bdd51c3-6012-4360-9533-0ec1f476871a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T10:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.242.93.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T10:05:09.000Z",
      "valid_until": "2026-05-06T10:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T09:29:07.047Z",
      "x_nadsec_last_seen": "2026-04-04T09:33:05.048Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-04-04T10:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PE; asn=27843; asn_org=WIN EMPRESAS S.A.C.",
      "id": "indicator--faec446f-e73e-4e65-92b0-77ff9ebafd65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T10:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '170.233.146.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T10:05:09.000Z",
      "valid_until": "2026-05-06T10:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-04T09:52:32.263Z",
      "x_nadsec_last_seen": "2026-04-05T15:15:23.483Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "27843"
      ],
      "x_nadsec_orgs": [
        "WIN EMPRESAS S.A.C."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-04T10:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=25369; asn_org=Hydra Communications Ltd",
      "id": "indicator--a15850d6-8c8f-4225-8da9-f266761a446b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T10:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.88.98.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T10:05:09.000Z",
      "valid_until": "2026-05-06T10:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-04T09:33:42.628Z",
      "x_nadsec_last_seen": "2026-04-04T13:55:46.636Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "25369"
      ],
      "x_nadsec_orgs": [
        "Hydra Communications Ltd"
      ]
    },
    {
      "created": "2026-04-04T10:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--bda317dd-29b5-4b52-aa15-d4faf86f291f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T10:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.233.40.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T10:05:09.000Z",
      "valid_until": "2026-05-06T10:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T09:31:14.787Z",
      "x_nadsec_last_seen": "2026-04-16T22:04:21.344Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-04-04T10:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=48479; asn_org=KUBAN-TELECOM Ltd.",
      "id": "indicator--7f7a25af-be17-49fe-9b9a-5683ab67f6bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T10:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.18.205.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T10:05:09.000Z",
      "valid_until": "2026-05-06T10:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T09:44:33.502Z",
      "x_nadsec_last_seen": "2026-04-04T09:50:11.501Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48479"
      ],
      "x_nadsec_orgs": [
        "KUBAN-TELECOM Ltd."
      ]
    },
    {
      "created": "2026-04-04T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--6abf4c1d-8eb2-47ad-81dd-bcb2ba9e5d58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.161.206.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T11:05:10.000Z",
      "valid_until": "2026-05-06T11:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T10:30:52.675Z",
      "x_nadsec_last_seen": "2026-04-04T10:32:57.821Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-04T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NG; asn=37148; asn_org=globacom-as",
      "id": "indicator--65bc2448-8189-4ef3-a3df-c75b49fc9848",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.211.52.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T11:05:10.000Z",
      "valid_until": "2026-05-06T11:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T10:29:23.659Z",
      "x_nadsec_last_seen": "2026-04-04T10:29:23.659Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "37148"
      ],
      "x_nadsec_orgs": [
        "globacom-as"
      ]
    },
    {
      "created": "2026-04-04T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--d5465120-adfe-4abf-874e-8be98240cefc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '42.115.107.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T11:05:10.000Z",
      "valid_until": "2026-05-06T11:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T10:55:16.588Z",
      "x_nadsec_last_seen": "2026-04-04T10:57:22.011Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-04-04T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--0506142a-55de-418f-a84a-5cb1686b5f50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T11:05:10.000Z",
      "valid_until": "2026-05-06T11:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-04T10:13:50.586Z",
      "x_nadsec_last_seen": "2026-04-22T02:35:03.008Z",
      "x_nadsec_ports": [
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-04T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--dac13386-c266-43d5-9bd5-0502d7c514e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T11:05:10.000Z",
      "valid_until": "2026-05-06T11:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T10:33:29.812Z",
      "x_nadsec_last_seen": "2026-04-04T10:33:29.812Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-04T12:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--5853b058-954c-4f93-af34-be7f0a1379cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T12:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.137.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T12:05:09.000Z",
      "valid_until": "2026-05-06T12:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-04T11:59:15.637Z",
      "x_nadsec_last_seen": "2026-04-04T11:59:15.962Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-04T12:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC; user(top)=a*******s; pass(top)=a********@",
      "id": "indicator--f71f1702-6875-4c54-a776-3632c4fef98a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T12:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.77.175.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T12:05:09.000Z",
      "valid_until": "2026-05-06T12:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-04T11:27:44.884Z",
      "x_nadsec_last_seen": "2026-04-23T12:37:14.427Z",
      "x_nadsec_ports": [
        "21",
        "27017",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-04-04T12:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=epmapper; ports=135; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--72f5f799-77c8-43d3-ae96-4fb1494a07d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T12:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T12:05:09.000Z",
      "valid_until": "2026-05-06T12:05:08.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-04T11:12:06.847Z",
      "x_nadsec_last_seen": "2026-04-04T11:13:26.646Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-04-04T12:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=epmapper; ports=135; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--c8f217ae-b265-42c4-b9a6-f6d8f081a934",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T12:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T12:05:09.000Z",
      "valid_until": "2026-05-06T12:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-04T11:12:17.648Z",
      "x_nadsec_last_seen": "2026-04-04T11:13:16.133Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-04-04T12:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=epmapper; ports=135; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--1777a83b-5ec0-4ef7-a154-66bb8f070ad2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T12:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T12:05:09.000Z",
      "valid_until": "2026-05-06T12:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-04T11:12:41.792Z",
      "x_nadsec_last_seen": "2026-04-04T11:13:11.114Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-04-04T12:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--e1df11e4-4d0b-4d3a-88aa-c20a18e30f48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T12:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T12:05:09.000Z",
      "valid_until": "2026-05-06T12:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T11:12:25.706Z",
      "x_nadsec_last_seen": "2026-04-04T11:12:25.706Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-04-04T12:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8905; asn_org=Digit One LLC",
      "id": "indicator--8df5af37-5eee-4764-add0-544dc9ab1988",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T12:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '93.89.186.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T12:05:09.000Z",
      "valid_until": "2026-05-06T12:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T11:28:27.707Z",
      "x_nadsec_last_seen": "2026-04-04T11:30:33.804Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8905"
      ],
      "x_nadsec_orgs": [
        "Digit One LLC"
      ]
    },
    {
      "created": "2026-04-04T13:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=506; services=smbd; ports=445; cc=RS; asn=13092; asn_org=Akademska mreza Republike Srbije - AMRES",
      "id": "indicator--7e16a27f-e29a-4026-b2a4-4e33aea5ef5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T13:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.91.111.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T13:05:19.000Z",
      "valid_until": "2026-05-06T13:05:08.000Z",
      "x_nadsec_event_count": 3151,
      "x_nadsec_first_seen": "2026-04-04T12:50:19.158Z",
      "x_nadsec_last_seen": "2026-04-04T13:45:27.402Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RS"
      ],
      "x_nadsec_asns": [
        "13092"
      ],
      "x_nadsec_orgs": [
        "Akademska mreza Republike Srbije - AMRES"
      ]
    },
    {
      "created": "2026-04-04T13:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--a6a170ee-9931-46f2-95a4-40c0382b36e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T13:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T13:05:19.000Z",
      "valid_until": "2026-05-06T13:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T12:24:22.900Z",
      "x_nadsec_last_seen": "2026-04-26T14:17:31.400Z",
      "x_nadsec_ports": [
        "3306",
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "mysqld",
        "epmapper",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-04T13:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=FR; asn=34177; asn_org=Celeste SAS",
      "id": "indicator--60fa3c33-100d-47e8-a520-7e6aa7a4b007",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T13:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.156.80.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T13:05:19.000Z",
      "valid_until": "2026-05-06T13:05:08.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-04-04T12:18:50.636Z",
      "x_nadsec_last_seen": "2026-04-07T03:30:23.555Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "34177"
      ],
      "x_nadsec_orgs": [
        "Celeste SAS"
      ]
    },
    {
      "created": "2026-04-04T13:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--588705a4-11db-4903-95f7-b239aaa6d307",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T13:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T13:05:19.000Z",
      "valid_until": "2026-05-06T13:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T12:32:50.983Z",
      "x_nadsec_last_seen": "2026-04-04T12:32:50.983Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-04T13:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--03a657e1-84a2-4ef6-aeb7-b47d1890f246",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T13:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '88.247.206.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T13:05:19.000Z",
      "valid_until": "2026-05-06T13:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-04T12:59:52.603Z",
      "x_nadsec_last_seen": "2026-04-04T13:07:01.785Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-04T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=47; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--978255b1-864a-4d5d-bf57-97b0e22744a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '106.228.115.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T14:05:10.000Z",
      "valid_until": "2026-05-06T14:05:09.000Z",
      "x_nadsec_event_count": 47,
      "x_nadsec_first_seen": "2026-04-04T13:30:23.396Z",
      "x_nadsec_last_seen": "2026-04-04T13:35:22.614Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-04T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--5e08527d-0e7d-47fc-aafa-efaa5e5a12b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '180.253.181.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T14:05:10.000Z",
      "valid_until": "2026-05-06T14:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-04T13:18:10.312Z",
      "x_nadsec_last_seen": "2026-04-04T13:24:42.654Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-04T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=DE; asn=25369; asn_org=Hydra Communications Ltd",
      "id": "indicator--39304b36-677a-49a0-9b6b-6bacc7fbe534",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.88.98.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T14:05:10.000Z",
      "valid_until": "2026-05-06T14:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-04T13:35:01.102Z",
      "x_nadsec_last_seen": "2026-04-04T22:50:12.746Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "25369"
      ],
      "x_nadsec_orgs": [
        "Hydra Communications Ltd"
      ]
    },
    {
      "created": "2026-04-04T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=GB; asn=25369; asn_org=Hydra Communications Ltd",
      "id": "indicator--bb97fec4-4c4c-49e4-b4b9-5b561749e909",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.140.214.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T14:05:10.000Z",
      "valid_until": "2026-05-06T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T13:43:56.812Z",
      "x_nadsec_last_seen": "2026-04-04T13:43:56.812Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "25369"
      ],
      "x_nadsec_orgs": [
        "Hydra Communications Ltd"
      ]
    },
    {
      "created": "2026-04-04T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--2df27012-fdac-407d-a868-ef0f12991db2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.14.72.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T14:05:10.000Z",
      "valid_until": "2026-05-06T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T13:58:13.404Z",
      "x_nadsec_last_seen": "2026-04-04T13:58:13.404Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-04T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--edbd0d4f-f6f2-4a8d-8cb6-7a87724fa014",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T14:05:10.000Z",
      "valid_until": "2026-05-06T14:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-04T13:59:38.225Z",
      "x_nadsec_last_seen": "2026-04-30T13:35:02.083Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-04T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--26d27c05-c8f1-4334-b6c9-a0ffba910759",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '78.29.126.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T14:05:10.000Z",
      "valid_until": "2026-05-06T14:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-04T13:08:16.575Z",
      "x_nadsec_last_seen": "2026-04-17T09:35:36.814Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-04T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--1c8b6b95-5ab0-4fff-8085-dc479e0f6f77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.105.124.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T14:05:10.000Z",
      "valid_until": "2026-05-06T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T13:46:45.379Z",
      "x_nadsec_last_seen": "2026-04-04T13:48:52.289Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-04T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--fc0ceb03-47d4-4ae2-9b5b-6f58f110053c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '88.248.10.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T14:05:10.000Z",
      "valid_until": "2026-05-06T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T13:51:17.015Z",
      "x_nadsec_last_seen": "2026-04-04T13:53:23.530Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-04T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation; user(top)=**",
      "id": "indicator--3462b620-a325-4579-b51d-38ca5b68f17e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.42.84.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T15:05:10.000Z",
      "valid_until": "2026-05-06T15:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T14:19:49.218Z",
      "x_nadsec_last_seen": "2026-04-04T14:19:49.218Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-04T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--b75b876f-bdfa-4fa0-8019-ed9e32e32864",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T15:05:10.000Z",
      "valid_until": "2026-05-06T15:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-04T14:36:18.189Z",
      "x_nadsec_last_seen": "2026-04-05T14:22:31.566Z",
      "x_nadsec_ports": [
        "135",
        "1723"
      ],
      "x_nadsec_services": [
        "epmapper",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-04T16:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e0d5ede3-d3d6-4aaa-ad8c-5b82365fe83b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T16:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '136.112.32.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T16:05:36.000Z",
      "valid_until": "2026-05-06T16:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-04T15:46:29.839Z",
      "x_nadsec_last_seen": "2026-04-20T05:59:25.849Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-04T16:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=7488; asn_org=CNServer LLC",
      "id": "indicator--8dcddffa-36b7-4e61-8a47-dcaa0e3b9e39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T16:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.34.144.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T16:05:36.000Z",
      "valid_until": "2026-05-06T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-04T15:12:45.082Z",
      "x_nadsec_last_seen": "2026-04-04T15:12:58.717Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "7488"
      ],
      "x_nadsec_orgs": [
        "CNServer LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "%****%"
      ]
    },
    {
      "created": "2026-04-04T16:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=PL; asn=206092; asn_org=F.n.s. Holdings Limited",
      "id": "indicator--8000c483-2eb0-4bba-b621-405e43a605df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T16:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '188.212.135.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T16:05:36.000Z",
      "valid_until": "2026-05-06T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T15:44:43.287Z",
      "x_nadsec_last_seen": "2026-04-04T15:44:43.287Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "206092"
      ],
      "x_nadsec_orgs": [
        "F.n.s. Holdings Limited"
      ]
    },
    {
      "created": "2026-04-04T16:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--5280637d-f44d-425e-a7a8-7a1a53451cc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T16:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.191.151.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T16:05:36.000Z",
      "valid_until": "2026-05-06T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T15:11:48.209Z",
      "x_nadsec_last_seen": "2026-04-04T15:11:48.209Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-04-04T16:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--4843d525-fcaf-43ec-a271-0f20ffb0c42f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T16:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.191.151.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T16:05:36.000Z",
      "valid_until": "2026-05-06T16:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-04-04T15:06:29.900Z",
      "x_nadsec_last_seen": "2026-04-24T12:17:05.066Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-04-04T16:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a956a6f7-ea2a-417e-b59d-d038c02e05fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T16:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T16:05:36.000Z",
      "valid_until": "2026-05-06T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T15:55:22.856Z",
      "x_nadsec_last_seen": "2026-04-04T15:55:22.856Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-04T16:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=DE; asn=8560; asn_org=IONOS SE; user(top)=s***e",
      "id": "indicator--51ecdc52-1328-49e1-9167-1db392e73a39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T16:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '217.160.200.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T16:05:36.000Z",
      "valid_until": "2026-05-06T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T15:58:16.518Z",
      "x_nadsec_last_seen": "2026-04-04T15:58:16.518Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "8560"
      ],
      "x_nadsec_orgs": [
        "IONOS SE"
      ],
      "x_nadsec_usernames_attempted": [
        "s***e"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-04T16:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AM; asn=44395; asn_org=Ucom CJSC",
      "id": "indicator--48badde7-7e31-4d0c-b047-f2516fd432bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T16:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.162.209.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T16:05:36.000Z",
      "valid_until": "2026-05-06T16:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-04-04T15:07:29.499Z",
      "x_nadsec_last_seen": "2026-04-22T07:03:14.268Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "44395"
      ],
      "x_nadsec_orgs": [
        "Ucom CJSC"
      ]
    },
    {
      "created": "2026-04-04T16:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--ff7c6c6c-6f15-4a73-b045-61340e4fc2b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T16:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T16:05:36.000Z",
      "valid_until": "2026-05-06T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T15:07:41.791Z",
      "x_nadsec_last_seen": "2026-04-04T15:07:41.791Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-04T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--fccb3f23-7a20-40c7-8585-34e46f4d39b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.90.99.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T17:05:10.000Z",
      "valid_until": "2026-05-06T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T16:26:12.374Z",
      "x_nadsec_last_seen": "2026-04-04T16:28:19.749Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-04-04T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=3216; asn_org=PVimpelCom",
      "id": "indicator--7ab4d906-b77a-45cf-874e-a5fb92ea0a85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.239.146.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T17:05:10.000Z",
      "valid_until": "2026-05-06T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-04T16:26:12.647Z",
      "x_nadsec_last_seen": "2026-04-04T16:34:28.308Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "3216"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-04-04T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e6673fcf-523b-44c2-8c1a-dd484fc27c9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T17:05:10.000Z",
      "valid_until": "2026-05-06T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T16:15:05.685Z",
      "x_nadsec_last_seen": "2026-04-04T16:15:05.685Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-04T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=18632; asn_org=Volcano Vision, Inc.; user(top)=s***e",
      "id": "indicator--2ea0a2fb-2ec0-421c-a757-1bf2d83a82b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '208.3.195.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T17:05:10.000Z",
      "valid_until": "2026-05-06T17:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-04T16:48:10.419Z",
      "x_nadsec_last_seen": "2026-04-11T22:45:55.530Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "18632"
      ],
      "x_nadsec_orgs": [
        "Volcano Vision, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "c**n",
        "s***e",
        "a***********r",
        "o*****r",
        "o******s"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-04T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=CH; asn=15169; asn_org=Google LLC",
      "id": "indicator--c9dcbb07-79f1-453d-8248-8d35904f64ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.216.183.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T17:05:10.000Z",
      "valid_until": "2026-05-06T17:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-04T16:26:47.453Z",
      "x_nadsec_last_seen": "2026-04-04T16:26:57.699Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "15169"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-04T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--f40026ba-15d8-4d87-b0dd-146854b0209b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '81.215.203.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T17:05:10.000Z",
      "valid_until": "2026-05-06T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-04T16:46:46.843Z",
      "x_nadsec_last_seen": "2026-04-04T16:53:50.228Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-04T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8402; asn_org=PVimpelCom",
      "id": "indicator--2f2a96cf-84bd-4df4-bdf0-cf93c64f81dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '95.25.4.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T17:05:10.000Z",
      "valid_until": "2026-05-06T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T16:56:54.065Z",
      "x_nadsec_last_seen": "2026-04-04T16:59:01.367Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8402"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-04-04T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--947ef309-0ce3-45ce-8c76-9b1e1c07b727",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '161.35.115.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T18:05:10.000Z",
      "valid_until": "2026-05-06T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-04T17:25:17.803Z",
      "x_nadsec_last_seen": "2026-04-05T02:56:12.849Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-04T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=215540; asn_org=Global Connectivity Solutions Llp",
      "id": "indicator--ad100906-6650-4d02-8058-ae0bbf769cc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.130.47.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T18:05:10.000Z",
      "valid_until": "2026-05-06T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-04T17:53:11.850Z",
      "x_nadsec_last_seen": "2026-04-28T16:04:21.530Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "215540"
      ],
      "x_nadsec_orgs": [
        "Global Connectivity Solutions Llp"
      ]
    },
    {
      "created": "2026-04-04T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=KE; asn=37061; asn_org=Safaricom",
      "id": "indicator--27d0d07b-efce-4d5f-9197-ed61a33d1509",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.248.159.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T18:05:10.000Z",
      "valid_until": "2026-05-06T18:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-04T17:37:32.354Z",
      "x_nadsec_last_seen": "2026-04-04T17:37:37.623Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "37061"
      ],
      "x_nadsec_orgs": [
        "Safaricom"
      ]
    },
    {
      "created": "2026-04-04T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--6fe425a5-f90d-4d1e-a537-778ec3a9d290",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.80.80.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T18:05:10.000Z",
      "valid_until": "2026-05-06T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T17:46:11.394Z",
      "x_nadsec_last_seen": "2026-04-29T15:34:46.427Z",
      "x_nadsec_ports": [
        "445",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-04T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VE; asn=6306; asn_org=TELEFONICA VENEZOLANA, C.A.",
      "id": "indicator--b4889467-5f9d-4eb8-9cbd-4083bce3b516",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '200.35.109.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T18:05:10.000Z",
      "valid_until": "2026-05-06T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T18:00:49.599Z",
      "x_nadsec_last_seen": "2026-04-04T18:02:55.767Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "6306"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA VENEZOLANA, C.A."
      ]
    },
    {
      "created": "2026-04-04T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--262664e4-2d19-4164-8626-97fa8af55489",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T18:05:10.000Z",
      "valid_until": "2026-05-06T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-04T17:25:13.021Z",
      "x_nadsec_last_seen": "2026-04-20T01:34:41.753Z",
      "x_nadsec_ports": [
        "21",
        "81"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-04T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=31; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e1e9da6f-1150-4a70-bc79-0e1ae7ddd52f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '206.189.184.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T18:05:10.000Z",
      "valid_until": "2026-05-06T18:05:09.000Z",
      "x_nadsec_event_count": 31,
      "x_nadsec_first_seen": "2026-04-04T17:22:26.390Z",
      "x_nadsec_last_seen": "2026-04-04T17:25:14.608Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-04T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--8eee3341-81f3-4450-aa66-fddfe840d4a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '39.153.252.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T18:05:10.000Z",
      "valid_until": "2026-05-06T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T17:55:14.374Z",
      "x_nadsec_last_seen": "2026-04-20T14:23:22.399Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-04-04T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--57dcbdbc-3253-4e91-a224-8d807efbe42f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '78.186.185.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T18:05:10.000Z",
      "valid_until": "2026-05-06T18:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-04T17:05:42.457Z",
      "x_nadsec_last_seen": "2026-04-04T17:13:41.656Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-04T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--7943bac2-06d5-418d-a7aa-1802e835f391",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T18:05:10.000Z",
      "valid_until": "2026-05-06T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T17:19:27.158Z",
      "x_nadsec_last_seen": "2026-04-04T17:19:27.158Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-04T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=46265; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--89a0fbe0-efec-409f-b98b-efcd037b7c49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T18:05:10.000Z",
      "valid_until": "2026-05-06T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T17:14:19.737Z",
      "x_nadsec_last_seen": "2026-04-28T19:06:20.177Z",
      "x_nadsec_ports": [
        "42",
        "33627",
        "46265"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-04T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--865944c3-6098-410a-add2-345a2debd5ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T18:05:10.000Z",
      "valid_until": "2026-05-06T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T17:16:36.826Z",
      "x_nadsec_last_seen": "2026-04-04T17:16:36.826Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-04T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--94ffdcb5-1f89-46a6-a13e-923c4761db50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T18:05:10.000Z",
      "valid_until": "2026-05-06T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T17:16:10.676Z",
      "x_nadsec_last_seen": "2026-04-04T17:16:10.676Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-04T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--ce68a723-072c-4c6c-9fa2-58d83d4c09c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T18:05:10.000Z",
      "valid_until": "2026-05-06T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T17:16:36.190Z",
      "x_nadsec_last_seen": "2026-04-04T17:16:36.190Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-04T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--9fcac7e4-bdaf-4d4e-acef-477230052070",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T18:05:10.000Z",
      "valid_until": "2026-05-06T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T17:16:10.325Z",
      "x_nadsec_last_seen": "2026-04-04T17:16:10.325Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-04T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f2525f9f-a598-482f-851b-05e5928327f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T19:05:05.000Z",
      "valid_until": "2026-05-06T19:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-04T18:28:43.205Z",
      "x_nadsec_last_seen": "2026-04-04T18:28:53.386Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-04T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=mssqld; ports=1433; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--f8956b90-5815-4dab-92c1-838d4ba79c00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.151.241.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T19:05:05.000Z",
      "valid_until": "2026-05-06T19:05:04.000Z",
      "x_nadsec_event_count": 85,
      "x_nadsec_first_seen": "2026-04-04T18:25:42.065Z",
      "x_nadsec_last_seen": "2026-04-30T17:02:29.689Z",
      "x_nadsec_ports": [
        "81",
        "3306",
        "1433",
        "445",
        "1723",
        "27017",
        "21"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld",
        "mssqld",
        "smbd",
        "mongod",
        "pptpd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-04T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--df2a58d0-186f-48e5-9681-61aa23f5e74c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.241.150.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T19:05:05.000Z",
      "valid_until": "2026-05-06T19:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-04T19:01:50.070Z",
      "x_nadsec_last_seen": "2026-04-18T19:31:05.135Z",
      "x_nadsec_ports": [
        "445",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-04T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=13188; asn_org=Content Delivery Network Ltd",
      "id": "indicator--71f5e0a2-dfaa-45a0-9a6f-49244349dbf4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.57.94.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T19:05:05.000Z",
      "valid_until": "2026-05-06T19:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T18:41:45.070Z",
      "x_nadsec_last_seen": "2026-04-04T18:43:51.358Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "13188"
      ],
      "x_nadsec_orgs": [
        "Content Delivery Network Ltd"
      ]
    },
    {
      "created": "2026-04-04T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--b4a575ee-b702-47fc-92c7-4c1ee2f9a092",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T19:05:05.000Z",
      "valid_until": "2026-05-06T19:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-04T18:21:21.211Z",
      "x_nadsec_last_seen": "2026-04-29T18:39:22.512Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-04T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8778c30b-79e8-4717-b8c8-41c64f3558d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T19:05:05.000Z",
      "valid_until": "2026-05-06T19:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T18:33:49.244Z",
      "x_nadsec_last_seen": "2026-04-10T23:13:11.270Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-04T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--509b0ccb-a518-41f4-b4c1-76a7ac44fa71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T19:05:05.000Z",
      "valid_until": "2026-05-06T19:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T18:05:20.702Z",
      "x_nadsec_last_seen": "2026-04-04T18:05:20.702Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-04T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--b7acd9e4-906f-45aa-a4b4-d49690b4fd5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T19:05:05.000Z",
      "valid_until": "2026-05-06T19:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T18:10:05.757Z",
      "x_nadsec_last_seen": "2026-04-04T18:10:05.757Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-04-04T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mqttd; ports=1883; cc=FR; asn=211590; asn_org=Bucklog SARL",
      "id": "indicator--77e68797-9c44-402b-83c7-dbac3775e751",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.177.72.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T21:05:10.000Z",
      "valid_until": "2026-05-06T21:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-04T20:33:01.820Z",
      "x_nadsec_last_seen": "2026-04-04T20:33:02.978Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "211590"
      ],
      "x_nadsec_orgs": [
        "Bucklog SARL"
      ]
    },
    {
      "created": "2026-04-04T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--53a03ca0-533e-4b09-97b6-902d116aace2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T21:05:10.000Z",
      "valid_until": "2026-05-06T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T20:46:53.113Z",
      "x_nadsec_last_seen": "2026-04-04T20:46:53.113Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-04-04T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--0c7e9cea-0347-489f-860b-74dae074f7c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '48.214.144.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T21:05:10.000Z",
      "valid_until": "2026-05-06T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-04T20:42:48.480Z",
      "x_nadsec_last_seen": "2026-04-04T20:42:58.651Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-04T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--3fd7a356-c5b7-408c-92a1-7dbcfff0fa05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '59.115.150.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T21:05:10.000Z",
      "valid_until": "2026-05-06T21:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-04T20:54:44.896Z",
      "x_nadsec_last_seen": "2026-04-04T20:58:55.402Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-04T22:06:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--54b92e74-b7e4-4e09-bdbb-8375e5ce717b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T22:06:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.236.205.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T22:06:07.000Z",
      "valid_until": "2026-05-06T22:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T21:53:59.394Z",
      "x_nadsec_last_seen": "2026-04-04T21:53:59.394Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-04T22:06:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--9ab720a2-0e81-4f26-bd3b-0e093db9f6ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T22:06:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T22:06:07.000Z",
      "valid_until": "2026-05-06T22:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T21:16:24.813Z",
      "x_nadsec_last_seen": "2026-04-24T05:14:22.245Z",
      "x_nadsec_ports": [
        "445",
        "135"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-04T22:06:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--e63b0269-c525-4bdc-acc6-b9ee1f695482",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T22:06:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T22:06:07.000Z",
      "valid_until": "2026-05-06T22:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T22:03:48.249Z",
      "x_nadsec_last_seen": "2026-04-04T22:03:48.249Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-04T22:06:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--b57a84c7-b815-4c90-add5-d9bc20735584",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T22:06:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T22:06:07.000Z",
      "valid_until": "2026-05-06T22:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T22:04:30.818Z",
      "x_nadsec_last_seen": "2026-04-04T22:04:30.818Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-04T22:06:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3c43ed44-ac38-4142-8826-5bc8dfeba74f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T22:06:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T22:06:07.000Z",
      "valid_until": "2026-05-06T22:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-04T22:04:31.158Z",
      "x_nadsec_last_seen": "2026-04-11T22:03:28.709Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-04T22:06:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--13f04f0d-4e10-4b39-a8f2-e40e59fbe5c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T22:06:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T22:06:07.000Z",
      "valid_until": "2026-05-06T22:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T22:03:48.382Z",
      "x_nadsec_last_seen": "2026-04-04T22:03:48.382Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-04T23:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--97c6049f-633b-4d51-b972-4f8fbcfc74fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T23:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.90.80.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T23:05:11.000Z",
      "valid_until": "2026-05-06T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T22:44:54.631Z",
      "x_nadsec_last_seen": "2026-04-04T22:47:03.211Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-04-04T23:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--9719bb5a-4bc8-4719-a760-c28c8b10df33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T23:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '116.103.230.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T23:05:11.000Z",
      "valid_until": "2026-05-06T23:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-04T22:13:28.778Z",
      "x_nadsec_last_seen": "2026-04-24T10:32:01.386Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-04T23:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--32bbdfa6-a96a-4407-8ece-b4beab06a336",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T23:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '122.237.58.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T23:05:11.000Z",
      "valid_until": "2026-05-06T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T22:25:02.609Z",
      "x_nadsec_last_seen": "2026-04-04T22:27:43.684Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-04T23:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=27699; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--e5852b1d-6b82-4b5d-9536-36f061603ec4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T23:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.254.177.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T23:05:11.000Z",
      "valid_until": "2026-05-06T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T22:51:39.387Z",
      "x_nadsec_last_seen": "2026-04-04T22:51:46.770Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "27699"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-04-04T23:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=FR; asn=16276; asn_org=OVH SAS",
      "id": "indicator--baa0659c-1658-4faf-9833-d606ad844fd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T23:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '188.165.159.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T23:05:11.000Z",
      "valid_until": "2026-05-06T23:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-04T22:56:33.592Z",
      "x_nadsec_last_seen": "2026-04-04T22:56:33.932Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ]
    },
    {
      "created": "2026-04-04T23:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=DE; asn=25369; asn_org=Hydra Communications Ltd",
      "id": "indicator--cfad93ba-67f3-4ce3-848a-612ca7fb145f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T23:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.88.98.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T23:05:11.000Z",
      "valid_until": "2026-05-06T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T22:59:19.563Z",
      "x_nadsec_last_seen": "2026-04-04T22:59:19.563Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "25369"
      ],
      "x_nadsec_orgs": [
        "Hydra Communications Ltd"
      ]
    },
    {
      "created": "2026-04-04T23:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--35466c43-5ed7-4c06-861b-8ba998dcad78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T23:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T23:05:11.000Z",
      "valid_until": "2026-05-06T23:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-04T22:38:41.376Z",
      "x_nadsec_last_seen": "2026-04-07T11:48:27.123Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-05T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--52d8d17e-a293-45ec-8943-d428297cf647",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '111.243.92.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T00:05:10.000Z",
      "valid_until": "2026-05-07T00:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T23:49:54.821Z",
      "x_nadsec_last_seen": "2026-04-04T23:51:59.590Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-05T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--b316c3a7-fd19-4715-90df-7f2089143fec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.96.23.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T00:05:10.000Z",
      "valid_until": "2026-05-07T00:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-04T23:15:42.015Z",
      "x_nadsec_last_seen": "2026-04-04T23:22:58.184Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-04-05T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ZA; asn=37611; asn_org=AFRIHOST-SP",
      "id": "indicator--7c1b62cd-86d8-4235-bac8-55b330a418c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '192.143.12.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T00:05:10.000Z",
      "valid_until": "2026-05-07T00:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-04T23:27:43.553Z",
      "x_nadsec_last_seen": "2026-04-04T23:27:43.585Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "37611"
      ],
      "x_nadsec_orgs": [
        "AFRIHOST-SP"
      ]
    },
    {
      "created": "2026-04-05T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=GB; asn=25369; asn_org=Hydra Communications Ltd",
      "id": "indicator--667ac802-4f3d-4bca-8ec4-3b4698e7afcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.140.214.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T00:05:10.000Z",
      "valid_until": "2026-05-07T00:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-04T23:07:37.619Z",
      "x_nadsec_last_seen": "2026-04-04T23:07:37.619Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "25369"
      ],
      "x_nadsec_orgs": [
        "Hydra Communications Ltd"
      ]
    },
    {
      "created": "2026-04-05T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IE; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e5df168c-ee0d-4e78-8b76-5945a1d04d0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.223.168.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T00:05:10.000Z",
      "valid_until": "2026-05-07T00:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T23:43:38.287Z",
      "x_nadsec_last_seen": "2026-04-09T02:37:54.426Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IE"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-05T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--0253a538-8ee0-40d5-906f-33dac56090b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T00:05:10.000Z",
      "valid_until": "2026-05-07T00:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T00:01:17.860Z",
      "x_nadsec_last_seen": "2026-04-05T00:01:17.860Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-05T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=mongod; ports=27017; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--6a4c9230-cc1e-41ca-abeb-6a925f5e6752",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T00:05:10.000Z",
      "valid_until": "2026-05-07T00:05:08.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-04-04T23:12:57.256Z",
      "x_nadsec_last_seen": "2026-04-04T23:13:17.174Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-04-05T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ES; asn=15704; asn_org=Xtra Telecom S.A.",
      "id": "indicator--8a113cf9-2977-4bf5-b4a7-7ce44c960efb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '77.27.140.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T00:05:10.000Z",
      "valid_until": "2026-05-07T00:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-04T23:21:47.871Z",
      "x_nadsec_last_seen": "2026-04-04T23:21:47.921Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "15704"
      ],
      "x_nadsec_orgs": [
        "Xtra Telecom S.A."
      ]
    },
    {
      "created": "2026-04-05T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=33934; asn_org=Rostelecom",
      "id": "indicator--d4cf5aed-a7b9-49ef-89f7-cbf6c3ac41fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.173.85.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T00:05:10.000Z",
      "valid_until": "2026-05-07T00:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-04T23:56:49.975Z",
      "x_nadsec_last_seen": "2026-04-05T00:05:00.463Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "33934"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-05T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=133981; asn_org=PLAYERNET TECHNOLOGIES PVT LTD; user(top)=**",
      "id": "indicator--40722c38-43c8-480e-8b07-7d1bca71447f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.187.178.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T04:05:10.000Z",
      "valid_until": "2026-05-07T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T03:06:52.593Z",
      "x_nadsec_last_seen": "2026-04-05T03:06:52.593Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133981"
      ],
      "x_nadsec_orgs": [
        "PLAYERNET TECHNOLOGIES PVT LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-05T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--554c0a04-3c09-40e1-8373-c05d96005b24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '123.58.213.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T04:05:10.000Z",
      "valid_until": "2026-05-07T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T03:37:42.317Z",
      "x_nadsec_last_seen": "2026-04-05T03:37:42.317Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-05T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--7a89a6ec-24da-498e-abad-a9cf20b840c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.210.9.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T04:05:10.000Z",
      "valid_until": "2026-05-07T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T03:38:14.028Z",
      "x_nadsec_last_seen": "2026-04-05T03:38:14.028Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-05T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396356; asn_org=Latitude.sh; user(top)=c**n",
      "id": "indicator--dd544f1b-6b44-4179-9ef3-a9db99d8c2ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.34.105.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T04:05:10.000Z",
      "valid_until": "2026-05-07T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T03:57:54.631Z",
      "x_nadsec_last_seen": "2026-04-05T03:57:54.631Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396356"
      ],
      "x_nadsec_orgs": [
        "Latitude.sh"
      ],
      "x_nadsec_usernames_attempted": [
        "c**n"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-05T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--82c6706c-0c54-4538-99ab-bca4d9e48b72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.202.57.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T04:05:10.000Z",
      "valid_until": "2026-05-07T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-05T03:30:43.719Z",
      "x_nadsec_last_seen": "2026-04-28T02:56:56.513Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-05T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--46df56a8-fc00-476f-abed-944e682dce4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T04:05:10.000Z",
      "valid_until": "2026-05-07T04:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-05T03:58:11.278Z",
      "x_nadsec_last_seen": "2026-04-20T00:33:03.200Z",
      "x_nadsec_ports": [
        "135",
        "445",
        "27017",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod",
        "smbd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-05T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=JO; asn=8376; asn_org=Jordan Data Communications Company LLC",
      "id": "indicator--30006ed8-fd23-4e85-9ecc-a4bc7804cf3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.249.71.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T04:05:10.000Z",
      "valid_until": "2026-05-07T04:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-05T03:27:27.928Z",
      "x_nadsec_last_seen": "2026-04-05T03:29:33.453Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "8376"
      ],
      "x_nadsec_orgs": [
        "Jordan Data Communications Company LLC"
      ]
    },
    {
      "created": "2026-04-05T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=45528; asn_org=Tikona Infinet Ltd.",
      "id": "indicator--7e6f5ba8-5c72-46bf-bacb-c08197b72a3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.22.54.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T05:05:10.000Z",
      "valid_until": "2026-05-07T05:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-05T04:22:39.515Z",
      "x_nadsec_last_seen": "2026-04-05T04:29:25.280Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45528"
      ],
      "x_nadsec_orgs": [
        "Tikona Infinet Ltd."
      ]
    },
    {
      "created": "2026-04-05T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=17665; asn_org=ONEOTT INTERTAINMENT LIMITED",
      "id": "indicator--259d3fe3-461d-4046-9c24-dc20adf37ebc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.136.172.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T05:05:10.000Z",
      "valid_until": "2026-05-07T05:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T04:14:37.964Z",
      "x_nadsec_last_seen": "2026-04-05T04:14:37.964Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17665"
      ],
      "x_nadsec_orgs": [
        "ONEOTT INTERTAINMENT LIMITED"
      ]
    },
    {
      "created": "2026-04-05T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=63859; asn_org=PT. Eka Mas Republik",
      "id": "indicator--4515dfa9-a9ee-46a6-aacc-9a41a2e1d47b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.47.134.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T05:05:10.000Z",
      "valid_until": "2026-05-07T05:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-05T04:44:37.870Z",
      "x_nadsec_last_seen": "2026-04-05T04:44:37.984Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "63859"
      ],
      "x_nadsec_orgs": [
        "PT. Eka Mas Republik"
      ]
    },
    {
      "created": "2026-04-05T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=4755; asn_org=TATA Communications formerly VSNL is Leading ISP",
      "id": "indicator--f33883a1-bd69-49f4-9674-3da62e117bc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '121.240.127.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T05:05:10.000Z",
      "valid_until": "2026-05-07T05:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T04:14:37.803Z",
      "x_nadsec_last_seen": "2026-04-05T04:14:37.803Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "4755"
      ],
      "x_nadsec_orgs": [
        "TATA Communications formerly VSNL is Leading ISP"
      ]
    },
    {
      "created": "2026-04-05T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--e6dd4e9d-46f0-4b7c-a6de-950eb249838b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '128.185.19.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T05:05:10.000Z",
      "valid_until": "2026-05-07T05:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-05T04:26:04.708Z",
      "x_nadsec_last_seen": "2026-04-08T05:36:25.863Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-04-05T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=264104; asn_org=ZINE TELECOMUNICACOES PROVEDOR LTDA",
      "id": "indicator--62115071-b040-4cd6-99eb-402e9e781e95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.59.187.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T05:05:10.000Z",
      "valid_until": "2026-05-07T05:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-05T04:05:17.186Z",
      "x_nadsec_last_seen": "2026-04-05T04:12:17.658Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "264104"
      ],
      "x_nadsec_orgs": [
        "ZINE TELECOMUNICACOES PROVEDOR LTDA"
      ]
    },
    {
      "created": "2026-04-05T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=CN; asn=4847; asn_org=China Networks Inter-Exchange; user(top)=**",
      "id": "indicator--c6b19e25-e3d7-4a8d-8c47-23c0d695d930",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '218.245.1.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T05:05:10.000Z",
      "valid_until": "2026-05-07T05:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-05T04:47:52.151Z",
      "x_nadsec_last_seen": "2026-04-05T04:47:52.698Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4847"
      ],
      "x_nadsec_orgs": [
        "China Networks Inter-Exchange"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-05T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IE; asn=8075; asn_org=Microsoft Corporation; user(top)=**",
      "id": "indicator--cfdf302e-6d0a-4a41-b5ae-d2fa016cbdb3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '52.169.144.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T05:05:10.000Z",
      "valid_until": "2026-05-07T05:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T04:26:19.911Z",
      "x_nadsec_last_seen": "2026-04-05T04:26:19.911Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IE"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-05T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8fd5b17d-6cca-487d-989b-a91a9e7775bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T06:05:10.000Z",
      "valid_until": "2026-05-07T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-05T05:56:35.875Z",
      "x_nadsec_last_seen": "2026-04-05T05:56:36.650Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-05T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=139994; asn_org=PT XL Axiata Tbk",
      "id": "indicator--f61f9e82-2cbd-4d23-8ae1-ce5c8211ff36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '140.213.190.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T06:05:10.000Z",
      "valid_until": "2026-05-07T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-05T05:55:29.025Z",
      "x_nadsec_last_seen": "2026-04-05T05:55:33.585Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "139994"
      ],
      "x_nadsec_orgs": [
        "PT XL Axiata Tbk"
      ]
    },
    {
      "created": "2026-04-05T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--54c5e73b-efee-46e0-8469-2105f4e1f6da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T06:05:10.000Z",
      "valid_until": "2026-05-07T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T05:34:01.969Z",
      "x_nadsec_last_seen": "2026-04-05T05:34:01.969Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-05T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--7cd70405-0672-4690-9d7d-6fcf9511c009",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T06:05:10.000Z",
      "valid_until": "2026-05-07T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-05T05:33:51.711Z",
      "x_nadsec_last_seen": "2026-04-29T04:39:39.685Z",
      "x_nadsec_ports": [
        "81",
        "1723"
      ],
      "x_nadsec_services": [
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-05T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--afde109f-b49e-4f3e-932c-70cbd22986bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T06:05:10.000Z",
      "valid_until": "2026-05-07T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-05T05:22:15.828Z",
      "x_nadsec_last_seen": "2026-04-29T23:54:04.611Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-05T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=16135; asn_org=Turkcell Iletisim Hizmetleri A.s.",
      "id": "indicator--be348985-8f5f-4c37-b6b7-6acc0ac69be7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.26.44.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T06:05:10.000Z",
      "valid_until": "2026-05-07T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-05T05:31:58.941Z",
      "x_nadsec_last_seen": "2026-04-05T05:34:05.743Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "16135"
      ],
      "x_nadsec_orgs": [
        "Turkcell Iletisim Hizmetleri A.s."
      ]
    },
    {
      "created": "2026-04-05T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=RU; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--4be9893c-ff2f-4a2d-8e4d-8549e821930d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '156.229.16.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T07:05:10.000Z",
      "valid_until": "2026-05-07T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-05T02:10:38.869Z",
      "x_nadsec_last_seen": "2026-04-05T06:30:33.835Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-05T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--778cd591-d0b2-4053-802a-34848da80296",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '161.35.119.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T07:05:10.000Z",
      "valid_until": "2026-05-07T07:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-05T02:56:12.866Z",
      "x_nadsec_last_seen": "2026-04-05T06:51:04.013Z",
      "x_nadsec_ports": [
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-05T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--db1e4c83-21c2-4bf2-9853-e382a67f99b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '174.138.55.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T07:05:10.000Z",
      "valid_until": "2026-05-07T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T06:14:39.311Z",
      "x_nadsec_last_seen": "2026-04-05T06:14:39.311Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-05T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MX; asn=8151; asn_org=UNINET; user(top)=**",
      "id": "indicator--f62bb967-284b-4b62-b89c-21a4336a9f12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.162.95.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T07:05:10.000Z",
      "valid_until": "2026-05-07T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T06:12:57.304Z",
      "x_nadsec_last_seen": "2026-04-05T06:12:57.304Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-05T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CO; asn=14080; asn_org=Telmex Colombia S.A.",
      "id": "indicator--c0b1883c-29af-4019-a5f2-e8971e6db8fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.85.187.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T07:05:10.000Z",
      "valid_until": "2026-05-07T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-05T06:50:18.424Z",
      "x_nadsec_last_seen": "2026-04-05T06:57:28.610Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "14080"
      ],
      "x_nadsec_orgs": [
        "Telmex Colombia S.A."
      ]
    },
    {
      "created": "2026-04-05T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=TW; asn=396982; asn_org=Google LLC",
      "id": "indicator--6bc98b9d-fe97-468d-9243-054f21e9f539",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T07:05:10.000Z",
      "valid_until": "2026-05-07T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T06:43:07.095Z",
      "x_nadsec_last_seen": "2026-04-05T06:43:07.095Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-05T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--04895fbd-5d04-4b82-8698-745782f7767c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.40.216.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T07:05:10.000Z",
      "valid_until": "2026-05-07T07:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-05T06:37:02.527Z",
      "x_nadsec_last_seen": "2026-04-18T09:47:10.381Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-05T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f4f0ebad-4d0e-4286-b297-3a32142dc9da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '24.144.106.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T07:05:10.000Z",
      "valid_until": "2026-05-07T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T06:50:55.990Z",
      "x_nadsec_last_seen": "2026-04-05T06:50:55.990Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-05T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=51167; asn_org=Contabo GmbH",
      "id": "indicator--17f0557e-2305-4677-929d-05b8df41024a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.60.241.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T07:05:10.000Z",
      "valid_until": "2026-05-07T07:05:09.000Z",
      "x_nadsec_event_count": 18,
      "x_nadsec_first_seen": "2026-04-05T06:56:31.657Z",
      "x_nadsec_last_seen": "2026-04-28T15:01:56.674Z",
      "x_nadsec_ports": [
        "81",
        "21",
        "1433",
        "42",
        "135",
        "445",
        "1723",
        "3306",
        "35729"
      ],
      "x_nadsec_services": [
        "httpd",
        "ftpd",
        "mssqld",
        "epmapper",
        "mirrorc",
        "mirrord",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "51167"
      ],
      "x_nadsec_orgs": [
        "Contabo GmbH"
      ]
    },
    {
      "created": "2026-04-05T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--12eaf260-9f9e-44bb-81b2-7c0c4c0a9cbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T07:05:10.000Z",
      "valid_until": "2026-05-07T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T06:21:40.591Z",
      "x_nadsec_last_seen": "2026-04-05T06:21:40.591Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-05T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d361a550-913b-477c-9225-d16a447aafc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T07:05:10.000Z",
      "valid_until": "2026-05-07T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T06:21:40.268Z",
      "x_nadsec_last_seen": "2026-04-05T06:21:40.268Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-05T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=47524; asn_org=Turksat Uydu Haberlesme ve Kablo TV Isletme A.S.",
      "id": "indicator--930e6fde-d931-404d-a526-690edf3a7de4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '24.133.81.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T08:05:10.000Z",
      "valid_until": "2026-05-07T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-05T08:01:19.537Z",
      "x_nadsec_last_seen": "2026-04-05T08:03:26.696Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "47524"
      ],
      "x_nadsec_orgs": [
        "Turksat Uydu Haberlesme ve Kablo TV Isletme A.S."
      ]
    },
    {
      "created": "2026-04-05T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--4db8e4db-4f66-43ea-8b64-0edb51194b67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '61.145.150.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T08:05:10.000Z",
      "valid_until": "2026-05-07T08:05:09.000Z",
      "x_nadsec_event_count": 177,
      "x_nadsec_first_seen": "2026-04-05T07:20:52.888Z",
      "x_nadsec_last_seen": "2026-04-07T13:35:56.159Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-05T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--fcd9ba8d-19b2-48c0-a445-cb2e1377a7a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T08:05:10.000Z",
      "valid_until": "2026-05-07T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T07:31:19.858Z",
      "x_nadsec_last_seen": "2026-04-05T07:31:19.858Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-05T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BY; asn=6697; asn_org=Republican Unitary Telecommunication Enterprise Beltelecom; user(top)=s****r; pass(top)=d**o",
      "id": "indicator--74c1076d-2db6-451c-b4db-66027bf69595",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.126.104.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T09:05:10.000Z",
      "valid_until": "2026-05-07T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T08:54:53.187Z",
      "x_nadsec_last_seen": "2026-04-05T08:54:53.187Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BY"
      ],
      "x_nadsec_asns": [
        "6697"
      ],
      "x_nadsec_orgs": [
        "Republican Unitary Telecommunication Enterprise Beltelecom"
      ],
      "x_nadsec_usernames_attempted": [
        "s****r"
      ],
      "x_nadsec_passwords_attempted": [
        "d**o"
      ]
    },
    {
      "created": "2026-04-05T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--fd945581-3757-46a2-9e58-db0b88d8e790",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '217.165.117.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T09:05:10.000Z",
      "valid_until": "2026-05-07T09:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-05T08:09:36.395Z",
      "x_nadsec_last_seen": "2026-04-05T09:04:54.174Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ]
    },
    {
      "created": "2026-04-05T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--f153be6d-43e9-4dad-964e-a50645ee2578",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.77.163.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T09:05:10.000Z",
      "valid_until": "2026-05-07T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-05T08:49:01.748Z",
      "x_nadsec_last_seen": "2026-04-05T08:53:32.271Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-05T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BY; asn=6697; asn_org=Republican Unitary Telecommunication Enterprise Beltelecom",
      "id": "indicator--c0a1f273-5977-4010-9956-3ce73081e366",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.214.32.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T09:05:10.000Z",
      "valid_until": "2026-05-07T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-05T08:13:05.000Z",
      "x_nadsec_last_seen": "2026-04-05T08:20:05.987Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BY"
      ],
      "x_nadsec_asns": [
        "6697"
      ],
      "x_nadsec_orgs": [
        "Republican Unitary Telecommunication Enterprise Beltelecom"
      ]
    },
    {
      "created": "2026-04-05T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=45536; asn_org=Readylink Internet Services Limited; user(top)=**",
      "id": "indicator--1c778c44-03cb-4009-806e-5e95cdc84cbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '43.225.164.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T09:05:10.000Z",
      "valid_until": "2026-05-07T09:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-05T08:05:31.391Z",
      "x_nadsec_last_seen": "2026-04-06T18:41:06.139Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45536"
      ],
      "x_nadsec_orgs": [
        "Readylink Internet Services Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-05T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--f0912112-b13a-4795-93f0-3949ae5c98e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T09:05:10.000Z",
      "valid_until": "2026-05-07T09:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-05T08:06:46.845Z",
      "x_nadsec_last_seen": "2026-04-28T12:18:51.909Z",
      "x_nadsec_ports": [
        "81",
        "1723"
      ],
      "x_nadsec_services": [
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-05T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--a900aceb-7be8-4091-8f90-dc366247d001",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T09:05:10.000Z",
      "valid_until": "2026-05-07T09:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-05T08:35:01.923Z",
      "x_nadsec_last_seen": "2026-04-07T00:48:21.482Z",
      "x_nadsec_ports": [
        "445",
        "1723"
      ],
      "x_nadsec_services": [
        "smbd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-05T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--e02fff28-acd8-40b6-a647-927d62f03de3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '78.180.56.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T09:05:10.000Z",
      "valid_until": "2026-05-07T09:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-05T08:48:56.153Z",
      "x_nadsec_last_seen": "2026-04-05T09:25:10.791Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-05T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=9021; asn_org=Is Net Elektonik Bilgi Uretim Dagitim Ticaret ve Iletisim Hizmetleri A.S.",
      "id": "indicator--fe32dbe6-6b0c-44f3-b9ee-add7014e8d98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '90.159.15.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T09:05:10.000Z",
      "valid_until": "2026-05-07T09:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-05T08:14:39.394Z",
      "x_nadsec_last_seen": "2026-04-05T08:15:43.806Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9021"
      ],
      "x_nadsec_orgs": [
        "Is Net Elektonik Bilgi Uretim Dagitim Ticaret ve Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-04-05T10:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--deaf41b8-ad19-4c84-93ad-220c0704b6a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T10:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.133.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T10:05:01.000Z",
      "valid_until": "2026-05-07T10:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T09:27:21.229Z",
      "x_nadsec_last_seen": "2026-04-05T09:27:21.229Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-05T10:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--16f6efcf-59a3-42c8-b1ed-ed3f949f4c3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T10:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.182.58.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T10:05:01.000Z",
      "valid_until": "2026-05-07T10:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-05T09:29:15.737Z",
      "x_nadsec_last_seen": "2026-04-05T09:29:16.060Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-05T10:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--08aa3dd5-5ef9-49d4-8833-9b1588271fda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T10:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.86.73.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T10:05:01.000Z",
      "valid_until": "2026-05-07T10:05:00.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-05T09:20:19.468Z",
      "x_nadsec_last_seen": "2026-04-09T02:10:02.825Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-04-05T10:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HT; asn=52260; asn_org=Telecommunications de Haiti Teleco",
      "id": "indicator--0cd5a71e-36bc-46cb-aae6-f7620d6c48b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T10:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.1.193.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T10:05:01.000Z",
      "valid_until": "2026-05-07T10:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-05T09:55:40.839Z",
      "x_nadsec_last_seen": "2026-04-05T09:57:46.378Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HT"
      ],
      "x_nadsec_asns": [
        "52260"
      ],
      "x_nadsec_orgs": [
        "Telecommunications de Haiti Teleco"
      ]
    },
    {
      "created": "2026-04-05T10:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--4052e8b2-1350-46d0-a683-6e0daaee6a36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T10:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '216.180.246.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T10:05:01.000Z",
      "valid_until": "2026-05-07T10:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-05T09:55:54.961Z",
      "x_nadsec_last_seen": "2026-04-05T10:02:46.657Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-05T10:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=21; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--f4d96faf-a4cf-4db6-97f1-d8fdc62bf3a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T10:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '216.180.246.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T10:05:01.000Z",
      "valid_until": "2026-05-07T10:05:00.000Z",
      "x_nadsec_event_count": 21,
      "x_nadsec_first_seen": "2026-04-05T09:51:39.510Z",
      "x_nadsec_last_seen": "2026-04-05T09:59:53.980Z",
      "x_nadsec_ports": [
        "81",
        "445"
      ],
      "x_nadsec_services": [
        "httpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-05T10:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a618f563-3e40-4831-b4d7-09d9c0e3b805",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T10:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '216.180.246.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T10:05:01.000Z",
      "valid_until": "2026-05-07T10:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-05T09:40:46.052Z",
      "x_nadsec_last_seen": "2026-04-05T09:44:07.336Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-05T10:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--495e4692-5043-4b44-a343-2eabc6f48026",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T10:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T10:05:01.000Z",
      "valid_until": "2026-05-07T10:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-05T09:22:24.552Z",
      "x_nadsec_last_seen": "2026-04-30T23:37:08.136Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-05T10:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=215540; asn_org=Global Connectivity Solutions Llp",
      "id": "indicator--6220f191-542b-4474-b489-1ea33f6de62a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T10:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '78.153.155.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T10:05:01.000Z",
      "valid_until": "2026-05-07T10:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T09:39:55.064Z",
      "x_nadsec_last_seen": "2026-04-05T09:39:55.064Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "215540"
      ],
      "x_nadsec_orgs": [
        "Global Connectivity Solutions Llp"
      ]
    },
    {
      "created": "2026-04-05T11:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--d49f3bd3-ca05-405d-ae1c-ba867df1560e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T11:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '111.253.193.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T11:05:08.000Z",
      "valid_until": "2026-05-07T11:05:07.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-05T11:04:29.423Z",
      "x_nadsec_last_seen": "2026-04-05T11:06:34.086Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-05T11:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EC; asn=269935; asn_org=TAPIA FLORES OSCAR ALDO FIBRANET ZAMORA",
      "id": "indicator--6678ee79-6a8c-4669-9096-83a1ab858198",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T11:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.83.15.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T11:05:08.000Z",
      "valid_until": "2026-05-07T11:05:07.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-05T10:25:40.507Z",
      "x_nadsec_last_seen": "2026-04-05T10:30:53.209Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "269935"
      ],
      "x_nadsec_orgs": [
        "TAPIA FLORES OSCAR ALDO FIBRANET ZAMORA"
      ]
    },
    {
      "created": "2026-04-05T11:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--88e9aa8c-5443-4513-8fdd-10564d6652c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T11:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '216.180.246.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T11:05:08.000Z",
      "valid_until": "2026-05-07T11:05:07.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-05T10:06:32.385Z",
      "x_nadsec_last_seen": "2026-04-05T10:10:51.658Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-05T11:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=17; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--ec1ef34c-2bd3-4d4e-96e4-364bbf90afdc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T11:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '216.180.246.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T11:05:08.000Z",
      "valid_until": "2026-05-07T11:05:07.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-04-05T10:40:29.975Z",
      "x_nadsec_last_seen": "2026-04-05T10:40:48.971Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-05T11:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--261da30c-84e0-4f21-ab04-7d2871921778",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T11:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '216.180.246.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T11:05:08.000Z",
      "valid_until": "2026-05-07T11:05:07.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-05T10:08:42.383Z",
      "x_nadsec_last_seen": "2026-04-05T10:14:19.320Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-05T11:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=200593; asn_org=Prospero Ooo",
      "id": "indicator--15d786a1-b30c-44d0-8db6-b0517ef1da37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T11:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.215.85.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T11:05:08.000Z",
      "valid_until": "2026-05-07T11:05:07.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-05T10:28:23.690Z",
      "x_nadsec_last_seen": "2026-04-05T10:28:31.695Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "200593"
      ],
      "x_nadsec_orgs": [
        "Prospero Ooo"
      ]
    },
    {
      "created": "2026-04-05T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=HK; asn=138195; asn_org=MOACK.Co.LTD",
      "id": "indicator--0d15620e-d0f9-4a3f-a3ef-26b2fa33a75d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.208.32.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T12:05:10.000Z",
      "valid_until": "2026-05-07T12:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-05T11:43:26.256Z",
      "x_nadsec_last_seen": "2026-04-05T11:49:54.065Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "138195"
      ],
      "x_nadsec_orgs": [
        "MOACK.Co.LTD"
      ]
    },
    {
      "created": "2026-04-05T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=HK; asn=134365; asn_org=Ansheng Network Technology Co., Limited",
      "id": "indicator--3e1ea4cd-1a34-4f78-948e-c2fd8b24eb69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.194.251.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T12:05:10.000Z",
      "valid_until": "2026-05-07T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-05T11:51:40.324Z",
      "x_nadsec_last_seen": "2026-04-09T23:18:41.337Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "134365"
      ],
      "x_nadsec_orgs": [
        "Ansheng Network Technology Co., Limited"
      ]
    },
    {
      "created": "2026-04-05T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=2561; asn_org=EUN",
      "id": "indicator--5bdc6387-dc91-4123-b443-6814779a77c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '193.227.47.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T12:05:10.000Z",
      "valid_until": "2026-05-07T12:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-05T12:03:01.163Z",
      "x_nadsec_last_seen": "2026-04-05T12:04:57.721Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "2561"
      ],
      "x_nadsec_orgs": [
        "EUN"
      ]
    },
    {
      "created": "2026-04-05T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=NL; asn=205759; asn_org=Ghosty Networks LLC; user(top)=r**t",
      "id": "indicator--de42fff2-76c8-4dad-876f-1ad35b8a80cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.151.182.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T12:05:10.000Z",
      "valid_until": "2026-05-07T12:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-05T11:24:56.232Z",
      "x_nadsec_last_seen": "2026-04-22T08:27:57.526Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "205759"
      ],
      "x_nadsec_orgs": [
        "Ghosty Networks LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-05T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--07f4c969-98be-4f62-bb7c-c04e7403d635",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T12:05:10.000Z",
      "valid_until": "2026-05-07T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T11:30:33.535Z",
      "x_nadsec_last_seen": "2026-04-05T11:30:33.535Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-05T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--e920171c-d429-47e8-92e8-9922d00475be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T12:05:10.000Z",
      "valid_until": "2026-05-07T12:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-05T11:55:26.642Z",
      "x_nadsec_last_seen": "2026-04-16T11:45:23.581Z",
      "x_nadsec_ports": [
        "135",
        "42",
        "81",
        "39433"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd",
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-05T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--5b3bf0c3-91cf-4cf5-bf81-a08a11be79db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T12:05:10.000Z",
      "valid_until": "2026-05-07T12:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-05T12:00:15.891Z",
      "x_nadsec_last_seen": "2026-04-28T04:16:59.186Z",
      "x_nadsec_ports": [
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-05T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--a4910374-7ae1-43f9-9e24-233e9a3e71fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '106.222.215.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T13:05:10.000Z",
      "valid_until": "2026-05-07T13:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-05T12:27:29.592Z",
      "x_nadsec_last_seen": "2026-04-05T12:34:40.587Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-04-05T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=NL; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--2f01a3fd-3ed1-4896-a75f-008f77ed7e51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '188.166.83.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T13:05:10.000Z",
      "valid_until": "2026-05-07T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-05T12:53:24.904Z",
      "x_nadsec_last_seen": "2026-04-05T12:53:28.189Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-05T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PH; asn=135607; asn_org=Infinivan Incorporated",
      "id": "indicator--89d8a47c-82f8-4e18-99f1-c2305aca2cc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '61.245.123.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T13:05:10.000Z",
      "valid_until": "2026-05-07T13:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-05T12:35:23.251Z",
      "x_nadsec_last_seen": "2026-04-05T12:41:50.527Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "135607"
      ],
      "x_nadsec_orgs": [
        "Infinivan Incorporated"
      ]
    },
    {
      "created": "2026-04-05T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--330f320b-4f3c-48ba-9e6e-b15f4095b47a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T13:05:10.000Z",
      "valid_until": "2026-05-07T13:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-05T12:12:45.537Z",
      "x_nadsec_last_seen": "2026-04-23T14:18:06.868Z",
      "x_nadsec_ports": [
        "445",
        "81",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "httpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-05T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=29190; asn_org=MTS PJSC",
      "id": "indicator--35a4de61-95fe-4ced-8551-f48e3b0c5ed3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.229.237.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T13:05:10.000Z",
      "valid_until": "2026-05-07T13:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-05T13:04:13.449Z",
      "x_nadsec_last_seen": "2026-04-05T13:12:09.386Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "29190"
      ],
      "x_nadsec_orgs": [
        "MTS PJSC"
      ]
    },
    {
      "created": "2026-04-05T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--ad8923ea-22c6-4df2-992b-12005660ce5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.164.215.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T14:05:10.000Z",
      "valid_until": "2026-05-07T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-05T13:26:02.607Z",
      "x_nadsec_last_seen": "2026-04-05T13:26:08.636Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-05T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=SG; asn=147181; asn_org=Flarezen Ltd.; user(top)=**",
      "id": "indicator--5f198d84-0c1e-4750-9212-629de4a63067",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.191.50.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T14:05:10.000Z",
      "valid_until": "2026-05-07T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T13:10:43.333Z",
      "x_nadsec_last_seen": "2026-04-05T13:10:43.333Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "147181"
      ],
      "x_nadsec_orgs": [
        "Flarezen Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-05T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--37829298-9dad-4adc-bf3e-0a8a43308c43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.248.21.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T14:05:10.000Z",
      "valid_until": "2026-05-07T14:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-05T13:29:33.935Z",
      "x_nadsec_last_seen": "2026-04-05T13:36:49.845Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-05T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=NL; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--eecf8e90-1558-4735-9cf8-a7231107343b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '161.35.93.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T14:05:10.000Z",
      "valid_until": "2026-05-07T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T13:29:08.674Z",
      "x_nadsec_last_seen": "2026-04-05T13:29:08.674Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-05T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--c56c651d-fbc7-4369-8be5-c5a178a74944",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T14:05:10.000Z",
      "valid_until": "2026-05-07T14:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-05T13:30:37.298Z",
      "x_nadsec_last_seen": "2026-04-28T10:42:42.490Z",
      "x_nadsec_ports": [
        "445",
        "3306",
        "81",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "mysqld",
        "httpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-05T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--2122837a-2e82-43b9-b2f4-86012a485028",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T14:05:10.000Z",
      "valid_until": "2026-05-07T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T13:42:00.330Z",
      "x_nadsec_last_seen": "2026-04-05T13:42:00.330Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-05T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--2ed3ed07-c19e-40eb-8e47-0ce2d82ad92f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T14:05:10.000Z",
      "valid_until": "2026-05-07T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T13:32:00.002Z",
      "x_nadsec_last_seen": "2026-04-05T13:32:00.002Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-05T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--97a44429-7642-4467-9bc7-8117049e9a8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '78.186.163.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T14:05:10.000Z",
      "valid_until": "2026-05-07T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-05T13:52:25.223Z",
      "x_nadsec_last_seen": "2026-04-05T13:54:31.725Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-05T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--41be4700-30c9-4139-83cc-148f222bb087",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '95.9.157.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T14:05:10.000Z",
      "valid_until": "2026-05-07T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-05T13:45:56.098Z",
      "x_nadsec_last_seen": "2026-04-05T13:48:02.939Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-05T15:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=ZA; asn=327782; asn_org=METROFIBRE-NETWORX",
      "id": "indicator--e355d301-9442-4e6b-bb36-59a3cc28e065",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T15:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.33.152.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T15:05:01.000Z",
      "valid_until": "2026-05-07T15:05:00.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-04-05T14:47:47.247Z",
      "x_nadsec_last_seen": "2026-04-05T14:50:42.305Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "327782"
      ],
      "x_nadsec_orgs": [
        "METROFIBRE-NETWORX"
      ]
    },
    {
      "created": "2026-04-05T15:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--77866f86-b553-4864-9d8e-caa1f1848b10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T15:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '112.26.50.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T15:05:01.000Z",
      "valid_until": "2026-05-07T15:05:00.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-05T14:14:35.308Z",
      "x_nadsec_last_seen": "2026-04-27T02:45:30.300Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-05T15:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NP; asn=23752; asn_org=Nepal Telecommunications Corporation, Internet Services",
      "id": "indicator--1f6c434f-5408-40a0-a1a5-063be89d728e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T15:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.199.229.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T15:05:01.000Z",
      "valid_until": "2026-05-07T15:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T14:17:40.929Z",
      "x_nadsec_last_seen": "2026-04-05T14:17:40.929Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NP"
      ],
      "x_nadsec_asns": [
        "23752"
      ],
      "x_nadsec_orgs": [
        "Nepal Telecommunications Corporation, Internet Services"
      ]
    },
    {
      "created": "2026-04-05T15:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--efaf1dc1-0a30-4296-8394-918dc5a23df5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T15:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.237.127.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T15:05:01.000Z",
      "valid_until": "2026-05-07T15:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-05T14:12:39.780Z",
      "x_nadsec_last_seen": "2026-04-12T23:03:54.254Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-05T15:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BY; asn=6697; asn_org=Republican Unitary Telecommunication Enterprise Beltelecom; user(top)=**",
      "id": "indicator--ca7e281d-9863-4bbf-888f-a29d764ad697",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T15:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.124.167.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T15:05:01.000Z",
      "valid_until": "2026-05-07T15:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-05T14:22:43.876Z",
      "x_nadsec_last_seen": "2026-04-27T02:31:13.645Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BY"
      ],
      "x_nadsec_asns": [
        "6697"
      ],
      "x_nadsec_orgs": [
        "Republican Unitary Telecommunication Enterprise Beltelecom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-05T15:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--7e16542a-fa6b-4953-b001-a381e47c7c25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T15:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.202.71.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T15:05:01.000Z",
      "valid_until": "2026-05-07T15:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-05T15:01:14.178Z",
      "x_nadsec_last_seen": "2026-04-05T15:01:14.270Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-05T15:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--f0577243-9763-452f-b40d-f654fad67f61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T15:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.218.203.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T15:05:01.000Z",
      "valid_until": "2026-05-07T15:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-05T14:55:47.186Z",
      "x_nadsec_last_seen": "2026-04-05T14:57:53.636Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-05T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17665; asn_org=ONEOTT INTERTAINMENT LIMITED",
      "id": "indicator--5e3141a5-0543-47f6-8fdd-74a0cad77599",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '203.194.105.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T16:05:10.000Z",
      "valid_until": "2026-05-07T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-05T15:11:55.652Z",
      "x_nadsec_last_seen": "2026-04-05T15:14:00.527Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17665"
      ],
      "x_nadsec_orgs": [
        "ONEOTT INTERTAINMENT LIMITED"
      ]
    },
    {
      "created": "2026-04-05T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--2cf091b7-1937-467e-ab0e-7688b9992b3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T16:05:10.000Z",
      "valid_until": "2026-05-07T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T15:59:13.790Z",
      "x_nadsec_last_seen": "2026-04-05T15:59:13.790Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-05T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=mssqld; ports=1433; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; user(top)=**",
      "id": "indicator--8cbe76d0-2b5d-4034-b4d2-7b021a9e2aac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.94.97.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T16:05:10.000Z",
      "valid_until": "2026-05-07T16:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-05T15:42:50.588Z",
      "x_nadsec_last_seen": "2026-04-07T13:33:55.147Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-05T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TW; asn=3462; asn_org=Data Communication Business Group; user(top)=**",
      "id": "indicator--c8eeb4c5-3cb1-488d-99ea-9ed61f274c04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '59.125.131.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T16:05:10.000Z",
      "valid_until": "2026-05-07T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-05T15:15:40.038Z",
      "x_nadsec_last_seen": "2026-04-22T22:11:24.815Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-05T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--67d229f0-0bc1-43c4-95a7-ff0be8b306b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T16:05:10.000Z",
      "valid_until": "2026-05-07T16:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-05T15:15:15.040Z",
      "x_nadsec_last_seen": "2026-04-28T14:57:13.166Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-05T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--ec6fb90d-ec91-43b0-9143-b816fc7b95e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T16:05:10.000Z",
      "valid_until": "2026-05-07T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-05T15:28:04.099Z",
      "x_nadsec_last_seen": "2026-04-18T03:15:49.963Z",
      "x_nadsec_ports": [
        "81",
        "1723",
        "1883"
      ],
      "x_nadsec_services": [
        "httpd",
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-05T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--3848a762-7f7d-4f2e-ba5c-d9cb4b853a14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.89.22.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T17:05:10.000Z",
      "valid_until": "2026-05-07T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-05T16:14:23.037Z",
      "x_nadsec_last_seen": "2026-04-05T16:16:38.651Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-04-05T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=ID; asn=64030; asn_org=Politeknik Negeri Semarang; user(top)=**",
      "id": "indicator--9d0572fe-0ea7-41dc-8207-f3f6048bca1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.214.229.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T17:05:10.000Z",
      "valid_until": "2026-05-07T17:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-05T16:28:47.720Z",
      "x_nadsec_last_seen": "2026-04-05T16:28:48.325Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "64030"
      ],
      "x_nadsec_orgs": [
        "Politeknik Negeri Semarang"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-05T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--2ff2b71c-8717-4d59-8763-3e97c67b279a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '111.243.0.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T17:05:10.000Z",
      "valid_until": "2026-05-07T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-05T16:32:30.661Z",
      "x_nadsec_last_seen": "2026-04-05T16:34:35.398Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-05T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=394089; asn_org=Google LLC",
      "id": "indicator--80c1baac-a607-46b6-9af5-5dbe6a9da325",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '153.72.20.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T17:05:10.000Z",
      "valid_until": "2026-05-07T17:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-05T16:06:21.767Z",
      "x_nadsec_last_seen": "2026-04-29T19:05:25.806Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "394089"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-05T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--be2d1787-e806-49f1-b370-fe52c3cfefe3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.129.42.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T17:05:10.000Z",
      "valid_until": "2026-05-07T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-05T16:38:17.280Z",
      "x_nadsec_last_seen": "2026-04-05T16:45:08.396Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-04-05T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VE; asn=11562; asn_org=Net Uno, C.A.",
      "id": "indicator--7a43ac8f-d938-4e4b-bcac-f173476151c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.6.56.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T17:05:10.000Z",
      "valid_until": "2026-05-07T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-05T16:39:17.881Z",
      "x_nadsec_last_seen": "2026-04-05T16:46:02.993Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "11562"
      ],
      "x_nadsec_orgs": [
        "Net Uno, C.A."
      ]
    },
    {
      "created": "2026-04-05T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--566d92f6-1198-4f93-92d1-4492949e2b2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T17:05:10.000Z",
      "valid_until": "2026-05-07T17:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-05T16:26:34.943Z",
      "x_nadsec_last_seen": "2026-04-24T23:02:07.490Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-05T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--478bab72-5ade-44c7-8221-97c4557d7611",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '216.180.246.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T17:05:10.000Z",
      "valid_until": "2026-05-07T17:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-05T17:04:16.544Z",
      "x_nadsec_last_seen": "2026-04-05T17:05:13.882Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-05T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=34; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--8062c84b-7b4c-4744-84f3-5431162b80bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.68.25.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T18:05:10.000Z",
      "valid_until": "2026-05-07T18:05:09.000Z",
      "x_nadsec_event_count": 34,
      "x_nadsec_first_seen": "2026-04-05T17:24:05.157Z",
      "x_nadsec_last_seen": "2026-04-05T17:24:59.571Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-05T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--3480c8a0-92bd-4db0-80fb-b8a0ea50cad7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.241.61.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T18:05:10.000Z",
      "valid_until": "2026-05-07T18:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-04-05T18:01:22.540Z",
      "x_nadsec_last_seen": "2026-04-05T19:25:09.371Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-05T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--bbe494ae-b47d-4ab8-85ee-6e713bd63203",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '159.65.98.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T18:05:10.000Z",
      "valid_until": "2026-05-07T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T17:23:54.830Z",
      "x_nadsec_last_seen": "2026-04-05T17:23:54.830Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-05T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=27951; asn_org=Media Commerce Partners S.A",
      "id": "indicator--c87d060d-0652-4823-8e63-418dc0c2dcba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '181.118.154.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T18:05:10.000Z",
      "valid_until": "2026-05-07T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-05T17:43:09.281Z",
      "x_nadsec_last_seen": "2026-04-05T17:45:15.090Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "27951"
      ],
      "x_nadsec_orgs": [
        "Media Commerce Partners S.A"
      ]
    },
    {
      "created": "2026-04-05T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--84233b09-9b4f-4769-a8f9-dff91b98e7e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T18:05:10.000Z",
      "valid_until": "2026-05-07T18:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-05T17:13:20.027Z",
      "x_nadsec_last_seen": "2026-04-16T15:21:37.918Z",
      "x_nadsec_ports": [
        "3306",
        "1883"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-05T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=21499; asn_org=Host Europe GmbH",
      "id": "indicator--584f033b-0f84-4b1d-b9be-a87c6edbb86b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '92.205.23.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T18:05:10.000Z",
      "valid_until": "2026-05-07T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T17:07:26.057Z",
      "x_nadsec_last_seen": "2026-04-05T17:07:26.057Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "21499"
      ],
      "x_nadsec_orgs": [
        "Host Europe GmbH"
      ]
    },
    {
      "created": "2026-04-05T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ed338e9b-213e-4615-8208-5d970da1b294",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.237.127.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T19:05:10.000Z",
      "valid_until": "2026-05-07T19:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-05T18:56:38.945Z",
      "x_nadsec_last_seen": "2026-04-05T18:56:39.337Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-05T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--ffa2558a-5fc1-49a5-82d9-dce38237a61f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.206.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T19:05:10.000Z",
      "valid_until": "2026-05-07T19:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-05T18:59:17.769Z",
      "x_nadsec_last_seen": "2026-04-05T18:59:40.046Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-05T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--2cad1e8e-d6c1-4405-87f0-fefd0c342dcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.207.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T19:05:10.000Z",
      "valid_until": "2026-05-07T19:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-05T18:46:00.127Z",
      "x_nadsec_last_seen": "2026-04-05T18:46:29.361Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-05T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b69a7a6e-80a4-4ae5-abbb-9a6c226053ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '161.35.125.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T19:05:10.000Z",
      "valid_until": "2026-05-07T19:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T18:37:33.219Z",
      "x_nadsec_last_seen": "2026-04-05T18:37:33.219Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-05T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RS; asn=31042; asn_org=Serbia BroadBand-Srpske Kablovske mreze d.o.o.",
      "id": "indicator--47c9256d-fb4b-4bee-bf41-d2c1b12e0a98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.148.173.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T19:05:10.000Z",
      "valid_until": "2026-05-07T19:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-05T18:11:15.249Z",
      "x_nadsec_last_seen": "2026-04-05T18:18:05.404Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RS"
      ],
      "x_nadsec_asns": [
        "31042"
      ],
      "x_nadsec_orgs": [
        "Serbia BroadBand-Srpske Kablovske mreze d.o.o."
      ]
    },
    {
      "created": "2026-04-05T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BR; asn=262753; asn_org=VOCE TELECOMUNICACOES LTDA",
      "id": "indicator--830c0ca1-afa9-444a-8bce-7dd14c529276",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '191.6.124.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T19:05:10.000Z",
      "valid_until": "2026-05-07T19:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-05T19:01:24.795Z",
      "x_nadsec_last_seen": "2026-04-05T19:09:14.232Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262753"
      ],
      "x_nadsec_orgs": [
        "VOCE TELECOMUNICACOES LTDA"
      ]
    },
    {
      "created": "2026-04-05T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=2609; asn_org=TN-BB-AS Tunisia BackBone AS",
      "id": "indicator--65ddd3bb-5c69-4d32-8dad-d3889ed931c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.203.226.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T19:05:10.000Z",
      "valid_until": "2026-05-07T19:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-05T18:22:37.486Z",
      "x_nadsec_last_seen": "2026-04-05T18:24:44.217Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "2609"
      ],
      "x_nadsec_orgs": [
        "TN-BB-AS Tunisia BackBone AS"
      ]
    },
    {
      "created": "2026-04-05T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=KR; asn=4766; asn_org=Korea Telecom; user(top)=**",
      "id": "indicator--15ebedc5-67bf-483a-b9fe-b132d32f7ebe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '221.147.200.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T19:05:10.000Z",
      "valid_until": "2026-05-07T19:05:08.000Z",
      "x_nadsec_event_count": 147,
      "x_nadsec_first_seen": "2026-04-05T18:58:32.301Z",
      "x_nadsec_last_seen": "2026-04-29T21:58:56.252Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "4766"
      ],
      "x_nadsec_orgs": [
        "Korea Telecom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-05T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--4dbcc8e3-a6b8-4bfb-a7df-77516d36d539",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T19:05:10.000Z",
      "valid_until": "2026-05-07T19:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-05T18:35:01.343Z",
      "x_nadsec_last_seen": "2026-04-26T07:31:42.640Z",
      "x_nadsec_ports": [
        "27017",
        "21",
        "1723",
        "1883"
      ],
      "x_nadsec_services": [
        "mongod",
        "ftpd",
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-05T20:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=TW; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--dc293e99-bd08-490a-bbc7-fb01bffe6735",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T20:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.164.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T20:05:15.000Z",
      "valid_until": "2026-05-07T20:05:14.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-05T19:41:07.916Z",
      "x_nadsec_last_seen": "2026-04-05T19:41:27.455Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-05T20:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--613a5a70-b58c-4ad4-b683-29cb42d00932",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T20:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.216.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T20:05:15.000Z",
      "valid_until": "2026-05-07T20:05:14.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T19:47:50.184Z",
      "x_nadsec_last_seen": "2026-04-05T19:47:50.184Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-05T20:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f5aa8e3f-b6f8-408b-8e01-3911d61ca4dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T20:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '164.92.86.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T20:05:15.000Z",
      "valid_until": "2026-05-07T20:05:14.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T19:29:12.748Z",
      "x_nadsec_last_seen": "2026-04-05T19:29:12.748Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-05T20:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b8ca905f-71ff-49ca-84af-990fddb7a75a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T20:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.42.95.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T20:05:15.000Z",
      "valid_until": "2026-05-07T20:05:14.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T19:09:39.530Z",
      "x_nadsec_last_seen": "2026-04-05T19:09:39.530Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-05T20:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--5d3cc13a-5dcc-46d5-aead-f966ab01025b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T20:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '27.56.144.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T20:05:15.000Z",
      "valid_until": "2026-05-07T20:05:14.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-05T19:20:22.772Z",
      "x_nadsec_last_seen": "2026-04-05T19:26:51.302Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-04-05T20:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; user(top)=**",
      "id": "indicator--21214d56-f488-479d-bd4f-5104d5fc8289",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T20:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '60.12.218.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T20:05:15.000Z",
      "valid_until": "2026-05-07T20:05:14.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T19:55:03.871Z",
      "x_nadsec_last_seen": "2026-04-05T19:55:03.871Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-05T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=135223; asn_org=Netway Internet Pvt Ltd",
      "id": "indicator--b7734e8e-6e29-4e33-91a0-edef25d78e7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.255.235.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T21:05:10.000Z",
      "valid_until": "2026-05-07T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-05T20:36:41.814Z",
      "x_nadsec_last_seen": "2026-04-05T20:38:46.784Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135223"
      ],
      "x_nadsec_orgs": [
        "Netway Internet Pvt Ltd"
      ]
    },
    {
      "created": "2026-04-05T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TW; asn=38841; asn_org=kbro CO. Ltd.",
      "id": "indicator--6679a0a6-2ed3-465f-826c-4f8faab2c4bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '123.195.0.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T21:05:10.000Z",
      "valid_until": "2026-05-07T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-05T21:00:49.144Z",
      "x_nadsec_last_seen": "2026-04-05T21:02:53.865Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "38841"
      ],
      "x_nadsec_orgs": [
        "kbro CO. Ltd."
      ]
    },
    {
      "created": "2026-04-05T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--75a6bb3d-6610-4ef3-8241-3471097d5398",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '144.172.96.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T21:05:10.000Z",
      "valid_until": "2026-05-07T21:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-05T20:21:36.358Z",
      "x_nadsec_last_seen": "2026-04-19T14:49:34.424Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-04-05T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--2e6d4418-65f5-4c7d-bc53-04e43e36154d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T21:05:10.000Z",
      "valid_until": "2026-05-07T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T20:34:27.153Z",
      "x_nadsec_last_seen": "2026-04-05T20:34:27.153Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-05T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IE; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--30e13408-4fe1-4e4c-bdda-57af9c02b497",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.82.167.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T21:05:10.000Z",
      "valid_until": "2026-05-07T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-05T20:39:43.668Z",
      "x_nadsec_last_seen": "2026-04-05T20:39:43.794Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IE"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-05T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=266579; asn_org=Oni Servico de Comunicacao e Multimidia Ltda",
      "id": "indicator--e5bb603e-1542-4bfa-ba32-91397d721e81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.7.9.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T21:05:10.000Z",
      "valid_until": "2026-05-07T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-05T21:00:54.255Z",
      "x_nadsec_last_seen": "2026-04-05T21:03:01.148Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "266579"
      ],
      "x_nadsec_orgs": [
        "Oni Servico de Comunicacao e Multimidia Ltda"
      ]
    },
    {
      "created": "2026-04-05T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--cf0af588-32b7-4293-ac29-f244792bb96d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '78.186.174.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T21:05:10.000Z",
      "valid_until": "2026-05-07T21:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-05T21:00:55.838Z",
      "x_nadsec_last_seen": "2026-04-05T21:08:00.835Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-05T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=204272; asn_org=ASARTA LLC",
      "id": "indicator--c2b4c59b-c3cb-4df3-99fe-f644e255293d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.108.209.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T22:05:10.000Z",
      "valid_until": "2026-05-07T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-05T21:32:46.437Z",
      "x_nadsec_last_seen": "2026-04-05T21:32:46.749Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "204272"
      ],
      "x_nadsec_orgs": [
        "ASARTA LLC"
      ]
    },
    {
      "created": "2026-04-05T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--4ff7d8f2-e861-44a9-98a6-b36ae5ddb8f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.239.52.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T22:05:10.000Z",
      "valid_until": "2026-05-07T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-05T21:33:10.945Z",
      "x_nadsec_last_seen": "2026-04-05T21:35:16.680Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-04-05T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--c3142f83-ccae-4f0a-95a9-a946df50a7ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.251.13.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T22:05:10.000Z",
      "valid_until": "2026-05-07T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T21:43:10.480Z",
      "x_nadsec_last_seen": "2026-04-05T21:43:10.480Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-05T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=71; services=mysqld; ports=3306; cc=IN; asn=135175; asn_org=Facts Online Pvt Ltd; user(top)=r**t",
      "id": "indicator--630dd591-20b2-467b-99fd-3887b9fabc13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.61.224.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T23:05:10.000Z",
      "valid_until": "2026-05-07T23:05:09.000Z",
      "x_nadsec_event_count": 289,
      "x_nadsec_first_seen": "2026-04-05T22:32:29.675Z",
      "x_nadsec_last_seen": "2026-04-27T08:43:11.571Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135175"
      ],
      "x_nadsec_orgs": [
        "Facts Online Pvt Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-05T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--d9eac281-71a0-4f95-88e4-f0165f4d4278",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '110.77.234.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T23:05:10.000Z",
      "valid_until": "2026-05-07T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-05T22:27:09.385Z",
      "x_nadsec_last_seen": "2026-04-05T22:29:14.365Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-04-05T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--b37642d3-ecbb-48c2-8646-365c3b2a4dee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '161.49.58.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T23:05:10.000Z",
      "valid_until": "2026-05-07T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-05T22:27:29.003Z",
      "x_nadsec_last_seen": "2026-04-05T22:29:33.381Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-04-05T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--657be241-58a6-49c3-bdcd-bff4ea43dce9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T23:05:10.000Z",
      "valid_until": "2026-05-07T23:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-05T22:09:22.888Z",
      "x_nadsec_last_seen": "2026-04-14T20:04:37.197Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-05T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--067a6e9e-9f53-43bd-8c63-2b8e757bd4ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T23:05:10.000Z",
      "valid_until": "2026-05-07T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-04T19:36:23.572Z",
      "x_nadsec_last_seen": "2026-04-22T16:05:19.347Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd",
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-05T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=25227; asn_org=JSC Avantel",
      "id": "indicator--5648de06-4687-45f6-8706-e1abe04abc12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '31.13.19.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T23:05:10.000Z",
      "valid_until": "2026-05-07T23:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-05T22:07:06.335Z",
      "x_nadsec_last_seen": "2026-04-05T22:14:27.155Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25227"
      ],
      "x_nadsec_orgs": [
        "JSC Avantel"
      ]
    },
    {
      "created": "2026-04-06T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--ac5dec64-5fae-43bf-ad0a-d5b235dcb169",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.172.240.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T00:05:05.000Z",
      "valid_until": "2026-05-08T00:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-05T23:11:41.185Z",
      "x_nadsec_last_seen": "2026-04-05T23:13:46.006Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-06T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--bccb7afc-f0db-43ca-a7ca-18525fb73a25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '125.164.87.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T00:05:05.000Z",
      "valid_until": "2026-05-08T00:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T00:04:18.015Z",
      "x_nadsec_last_seen": "2026-04-06T00:06:23.031Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-06T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mssqld; ports=1433; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--51384afc-78ea-4169-8b17-74346f420fc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '128.14.226.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T00:05:05.000Z",
      "valid_until": "2026-05-08T00:05:04.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-05T23:22:58.959Z",
      "x_nadsec_last_seen": "2026-04-05T23:23:56.507Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-06T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MA; asn=6713; asn_org=Itissalat Al-MAGHRIB; user(top)=**",
      "id": "indicator--7e1e06b3-9566-4beb-8c9e-b32ffcb7a55b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.146.235.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T00:05:05.000Z",
      "valid_until": "2026-05-08T00:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T00:03:45.845Z",
      "x_nadsec_last_seen": "2026-04-06T00:03:45.845Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "6713"
      ],
      "x_nadsec_orgs": [
        "Itissalat Al-MAGHRIB"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-06T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--85c229dc-a6fe-4c7c-8914-eb7d8dfab029",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.178.115.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T00:05:05.000Z",
      "valid_until": "2026-05-08T00:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-05T23:48:57.905Z",
      "x_nadsec_last_seen": "2026-04-05T23:48:58.697Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-06T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=GE; asn=208744; asn_org=UGT LLC",
      "id": "indicator--716afbda-671a-43f7-95ce-68e3b065c54a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.247.95.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T00:05:05.000Z",
      "valid_until": "2026-05-08T00:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-05T23:13:18.112Z",
      "x_nadsec_last_seen": "2026-04-05T23:13:18.112Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "208744"
      ],
      "x_nadsec_orgs": [
        "UGT LLC"
      ]
    },
    {
      "created": "2026-04-06T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--829191e5-fd48-4009-9de3-0d1ffbb6d11d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T00:05:05.000Z",
      "valid_until": "2026-05-08T00:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-05T23:31:30.038Z",
      "x_nadsec_last_seen": "2026-04-06T08:18:05.845Z",
      "x_nadsec_ports": [
        "445",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-06T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.; user(top)=**",
      "id": "indicator--544a8398-86cf-44ac-a669-f9cb956425d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.213.114.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T01:05:10.000Z",
      "valid_until": "2026-05-08T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T01:00:59.123Z",
      "x_nadsec_last_seen": "2026-04-06T01:00:59.123Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-06T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC; user(top)=**",
      "id": "indicator--e8eb0db8-9970-48dd-84e9-ff49b232f76a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.148.101.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T01:05:10.000Z",
      "valid_until": "2026-05-08T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T00:49:10.974Z",
      "x_nadsec_last_seen": "2026-04-06T00:49:10.974Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-06T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--893e1103-7d0b-439e-a89f-6a60e7559db9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.242.156.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T01:05:10.000Z",
      "valid_until": "2026-05-08T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T00:17:26.145Z",
      "x_nadsec_last_seen": "2026-04-06T00:19:32.570Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-04-06T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--daa9a3c5-f3ad-4b7d-b3de-8dfe0a2b5be5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '180.254.95.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T01:05:10.000Z",
      "valid_until": "2026-05-08T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-06T00:21:27.414Z",
      "x_nadsec_last_seen": "2026-04-06T00:21:27.642Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-06T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--41410656-3e25-479e-ad3b-55b19e4e5996",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.8.183.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T01:05:10.000Z",
      "valid_until": "2026-05-08T01:05:09.000Z",
      "x_nadsec_event_count": 3148,
      "x_nadsec_first_seen": "2026-04-06T00:33:45.858Z",
      "x_nadsec_last_seen": "2026-04-06T02:01:44.262Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-04-06T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--e7d99d17-2809-4aa4-b36f-6964e18e3bd7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '187.226.51.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T01:05:10.000Z",
      "valid_until": "2026-05-08T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-06T00:34:47.617Z",
      "x_nadsec_last_seen": "2026-04-06T00:34:47.698Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-04-06T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f0df9278-d605-4a87-be59-567ad0776013",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.184.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T01:05:10.000Z",
      "valid_until": "2026-05-08T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-06T00:21:12.216Z",
      "x_nadsec_last_seen": "2026-04-06T00:21:22.375Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-06T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--d2c72d93-36a0-43e6-8c78-81a428fa8d78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.90.2.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T01:05:10.000Z",
      "valid_until": "2026-05-08T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T00:58:22.813Z",
      "x_nadsec_last_seen": "2026-04-06T00:58:22.813Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-06T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=32098; asn_org=Transtelco Inc",
      "id": "indicator--8eecf478-1103-42c1-9caf-46013778d802",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.68.212.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T01:05:10.000Z",
      "valid_until": "2026-05-08T01:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-06T00:27:24.607Z",
      "x_nadsec_last_seen": "2026-04-06T00:27:59.861Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "32098"
      ],
      "x_nadsec_orgs": [
        "Transtelco Inc"
      ]
    },
    {
      "created": "2026-04-06T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--2e20e28a-9c92-4758-a4e4-eac8d68595e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T01:05:10.000Z",
      "valid_until": "2026-05-08T01:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-01T22:29:35.576Z",
      "x_nadsec_last_seen": "2026-04-07T09:18:07.461Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-04-06T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--01855052-601a-4625-b875-ed44080e3194",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.197.182.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T02:05:10.000Z",
      "valid_until": "2026-05-08T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T01:34:04.344Z",
      "x_nadsec_last_seen": "2026-04-06T01:34:04.344Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-06T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e02ed460-05cc-4184-b791-b2026c08832a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T02:05:10.000Z",
      "valid_until": "2026-05-08T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-06T01:28:21.752Z",
      "x_nadsec_last_seen": "2026-04-24T19:04:05.571Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-06T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=215540; asn_org=Global Connectivity Solutions Llp",
      "id": "indicator--62526437-6189-4345-8f18-11d3a2ff1f9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.130.47.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T02:05:10.000Z",
      "valid_until": "2026-05-08T02:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-06T01:28:13.157Z",
      "x_nadsec_last_seen": "2026-04-22T18:58:02.527Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "215540"
      ],
      "x_nadsec_orgs": [
        "Global Connectivity Solutions Llp"
      ]
    },
    {
      "created": "2026-04-06T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--b85cc997-bca1-48f3-b3c2-9e5894b315eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.176.84.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T02:05:10.000Z",
      "valid_until": "2026-05-08T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T01:17:36.229Z",
      "x_nadsec_last_seen": "2026-04-06T01:19:43.330Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-04-06T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--cd858af1-4bba-41b6-9637-ad7d4d0decc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.98.137.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T02:05:10.000Z",
      "valid_until": "2026-05-08T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-06T01:53:44.706Z",
      "x_nadsec_last_seen": "2026-04-06T01:53:54.879Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-06T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--b3ab6d9b-4400-4afd-98ab-09c70bf29805",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T02:05:10.000Z",
      "valid_until": "2026-05-08T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-06T01:59:50.558Z",
      "x_nadsec_last_seen": "2026-04-25T20:36:55.863Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-06T03:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=147185; asn_org=INFYNIX DATA SERVICES PRIVATE LIMITED",
      "id": "indicator--bf1631e1-b8c1-4acf-a61b-8279c62654f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T03:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.105.226.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T03:05:05.000Z",
      "valid_until": "2026-05-08T03:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T02:20:12.582Z",
      "x_nadsec_last_seen": "2026-04-06T02:22:17.507Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "147185"
      ],
      "x_nadsec_orgs": [
        "INFYNIX DATA SERVICES PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-04-06T03:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--738acdad-518b-416f-bf42-c17e758a94f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T03:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T03:05:05.000Z",
      "valid_until": "2026-05-08T03:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T02:32:04.060Z",
      "x_nadsec_last_seen": "2026-04-06T02:32:04.060Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-06T03:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=56044; asn_org=China Mobile communications corporation",
      "id": "indicator--038753e5-2675-42a7-b8a3-f05cf6ab2cae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T03:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '39.152.20.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T03:05:05.000Z",
      "valid_until": "2026-05-08T03:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T02:29:55.355Z",
      "x_nadsec_last_seen": "2026-04-06T02:32:00.553Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56044"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-04-06T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--e7a22934-0f24-4ef9-85ac-2264e8ef84eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '121.29.84.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T04:05:10.000Z",
      "valid_until": "2026-05-08T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T03:06:25.059Z",
      "x_nadsec_last_seen": "2026-04-06T03:06:25.059Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-04-06T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--4c4721e2-33c9-42f7-a573-47989e468cfb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '122.176.104.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T04:05:10.000Z",
      "valid_until": "2026-05-08T04:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-06T03:10:03.844Z",
      "x_nadsec_last_seen": "2026-04-06T04:56:57.254Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-04-06T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--6d18f78a-3b44-40bd-98ef-30a5b172f26f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '123.245.84.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T04:05:10.000Z",
      "valid_until": "2026-05-08T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T03:06:21.813Z",
      "x_nadsec_last_seen": "2026-04-06T03:06:21.813Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-06T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--fe282b66-fd23-4124-bb76-97daf36f2328",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '150.255.55.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T04:05:10.000Z",
      "valid_until": "2026-05-08T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T03:06:12.311Z",
      "x_nadsec_last_seen": "2026-04-06T03:06:12.311Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-04-06T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CO; asn=19429; asn_org=Colombia",
      "id": "indicator--4603954a-0eeb-4975-b5f7-78d3aef7dfba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.25.228.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T04:05:10.000Z",
      "valid_until": "2026-05-08T04:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-06T03:18:27.224Z",
      "x_nadsec_last_seen": "2026-04-06T03:25:32.203Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "19429"
      ],
      "x_nadsec_orgs": [
        "Colombia"
      ]
    },
    {
      "created": "2026-04-06T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=32475; asn_org=Internap Holding LLC",
      "id": "indicator--db1329b7-2e14-4a8e-a68a-c60ba5107d00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '203.55.131.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T04:05:10.000Z",
      "valid_until": "2026-05-08T04:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-06T03:27:48.773Z",
      "x_nadsec_last_seen": "2026-04-06T21:51:22.428Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "32475"
      ],
      "x_nadsec_orgs": [
        "Internap Holding LLC"
      ]
    },
    {
      "created": "2026-04-06T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=17621; asn_org=China Unicom Shanghai network",
      "id": "indicator--91905208-261b-42fa-ac87-fb419adb9dc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '223.166.22.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T04:05:10.000Z",
      "valid_until": "2026-05-08T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T03:06:23.520Z",
      "x_nadsec_last_seen": "2026-04-06T03:06:23.520Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "17621"
      ],
      "x_nadsec_orgs": [
        "China Unicom Shanghai network"
      ]
    },
    {
      "created": "2026-04-06T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--4528c8fa-2393-4efd-8d36-dbf345e640af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '223.199.173.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T04:05:10.000Z",
      "valid_until": "2026-05-08T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T03:06:15.435Z",
      "x_nadsec_last_seen": "2026-04-06T03:06:15.435Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-06T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=XK; asn=21246; asn_org=IPKO Telecommunications LLC",
      "id": "indicator--c82c5654-6a28-426b-a9cf-5c24e5b02a5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.99.137.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T04:05:10.000Z",
      "valid_until": "2026-05-08T04:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T03:31:56.890Z",
      "x_nadsec_last_seen": "2026-04-06T03:34:03.473Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "XK"
      ],
      "x_nadsec_asns": [
        "21246"
      ],
      "x_nadsec_orgs": [
        "IPKO Telecommunications LLC"
      ]
    },
    {
      "created": "2026-04-06T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--d7e931f1-ecc2-4f5c-9d77-356ce2f56205",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '60.16.221.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T04:05:10.000Z",
      "valid_until": "2026-05-08T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T03:06:13.711Z",
      "x_nadsec_last_seen": "2026-04-06T03:06:13.711Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-04-06T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--ed89394f-a113-4770-aa6c-c6452a3f45c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T04:05:10.000Z",
      "valid_until": "2026-05-08T04:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-06T03:54:28.740Z",
      "x_nadsec_last_seen": "2026-04-24T14:40:10.214Z",
      "x_nadsec_ports": [
        "21",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-06T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=24835; asn_org=RAYA Telecom - Egypt",
      "id": "indicator--f49f35e0-6921-4138-8a7d-b40a55d9cbcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.188.10.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T05:05:10.000Z",
      "valid_until": "2026-05-08T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T04:18:10.503Z",
      "x_nadsec_last_seen": "2026-04-14T20:41:19.546Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24835"
      ],
      "x_nadsec_orgs": [
        "RAYA Telecom - Egypt"
      ]
    },
    {
      "created": "2026-04-06T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--ffb4005d-b39f-442f-8390-f9a357c6cc46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.160.150.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T05:05:10.000Z",
      "valid_until": "2026-05-08T05:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-06T04:24:42.041Z",
      "x_nadsec_last_seen": "2026-04-21T15:40:32.153Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-06T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--14d8f6bd-57df-4f5d-a387-3398250363ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '180.249.161.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T05:05:10.000Z",
      "valid_until": "2026-05-08T05:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-06T04:39:51.346Z",
      "x_nadsec_last_seen": "2026-04-06T04:46:26.238Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-06T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH",
      "id": "indicator--e062c3b8-747b-44db-a625-e9122236d8bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T05:05:10.000Z",
      "valid_until": "2026-05-08T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T04:30:09.988Z",
      "x_nadsec_last_seen": "2026-04-06T04:30:09.988Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "215778"
      ],
      "x_nadsec_orgs": [
        "Alpha Strike Labs GmbH"
      ]
    },
    {
      "created": "2026-04-06T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--d6b4427e-edff-41f2-879e-c3834e1e9bf8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T05:05:10.000Z",
      "valid_until": "2026-05-08T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T04:18:58.267Z",
      "x_nadsec_last_seen": "2026-04-06T04:18:58.267Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-06T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--4403499d-ce52-4286-bd20-e5b1cd508db0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T05:05:10.000Z",
      "valid_until": "2026-05-08T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T04:53:50.573Z",
      "x_nadsec_last_seen": "2026-04-28T16:49:39.190Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-06T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--8c69ec80-389c-46ac-bbf4-ab3c67b19e7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T05:05:10.000Z",
      "valid_until": "2026-05-08T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T04:57:34.533Z",
      "x_nadsec_last_seen": "2026-04-11T15:09:27.514Z",
      "x_nadsec_ports": [
        "135",
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-06T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--7eed4ba1-6f09-4535-89f5-f2dde638edac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T05:05:10.000Z",
      "valid_until": "2026-05-08T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T04:50:36.753Z",
      "x_nadsec_last_seen": "2026-04-16T19:31:33.449Z",
      "x_nadsec_ports": [
        "135",
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-06T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ZA; asn=327693; asn_org=ECHO-SP",
      "id": "indicator--23e596c0-3ff5-413e-a1df-eebc2dfc223d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.67.178.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T06:05:06.000Z",
      "valid_until": "2026-05-08T06:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T05:23:55.233Z",
      "x_nadsec_last_seen": "2026-04-20T17:53:00.671Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "327693"
      ],
      "x_nadsec_orgs": [
        "ECHO-SP"
      ]
    },
    {
      "created": "2026-04-06T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=23674; asn_org=Nayatel Pvt Ltd",
      "id": "indicator--4135f321-6d04-486c-b9cb-a4802d7d38de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.192.105.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T06:05:06.000Z",
      "valid_until": "2026-05-08T06:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T05:44:31.436Z",
      "x_nadsec_last_seen": "2026-04-06T05:44:36.974Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23674"
      ],
      "x_nadsec_orgs": [
        "Nayatel Pvt Ltd"
      ]
    },
    {
      "created": "2026-04-06T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=20207; asn_org=Gigared S.A.",
      "id": "indicator--aed061ae-3f1f-4005-b0e6-8e9d4072e1af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.183.218.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T06:05:06.000Z",
      "valid_until": "2026-05-08T06:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T05:21:02.808Z",
      "x_nadsec_last_seen": "2026-04-06T05:23:10.544Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "20207"
      ],
      "x_nadsec_orgs": [
        "Gigared S.A."
      ]
    },
    {
      "created": "2026-04-06T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--b3c83928-f38e-4dd4-a0b4-d93793c398e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T06:05:06.000Z",
      "valid_until": "2026-05-08T06:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T05:06:11.814Z",
      "x_nadsec_last_seen": "2026-04-06T05:06:11.814Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-06T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24186; asn_org=RailTel Corporation of India Ltd",
      "id": "indicator--50d8f799-efb9-4969-8cc1-5b3c0b7f3ac9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '202.21.46.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T06:05:06.000Z",
      "valid_until": "2026-05-08T06:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T05:09:37.929Z",
      "x_nadsec_last_seen": "2026-04-06T05:11:42.666Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24186"
      ],
      "x_nadsec_orgs": [
        "RailTel Corporation of India Ltd"
      ]
    },
    {
      "created": "2026-04-06T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=50187; asn_org=BaikalWestCom",
      "id": "indicator--c8896f87-5745-457d-9ad1-ae5718fee0c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '212.67.31.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T06:05:06.000Z",
      "valid_until": "2026-05-08T06:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-06T05:44:49.474Z",
      "x_nadsec_last_seen": "2026-04-06T05:46:20.595Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "50187"
      ],
      "x_nadsec_orgs": [
        "BaikalWestCom"
      ]
    },
    {
      "created": "2026-04-06T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PL; asn=16342; asn_org=Toya sp.z.o.o; user(top)=**",
      "id": "indicator--9b189d53-10c7-424e-9a81-bf898cd4e143",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '31.182.57.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T06:05:06.000Z",
      "valid_until": "2026-05-08T06:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T05:34:20.225Z",
      "x_nadsec_last_seen": "2026-04-06T05:34:20.225Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "16342"
      ],
      "x_nadsec_orgs": [
        "Toya sp.z.o.o"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-06T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--264e4082-4d62-4bd6-9e14-0540fffccb12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.85.122.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T06:05:06.000Z",
      "valid_until": "2026-05-08T06:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-06T05:34:34.706Z",
      "x_nadsec_last_seen": "2026-04-06T05:34:34.929Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-06T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=56041; asn_org=China Mobile communications corporation",
      "id": "indicator--8f2173d3-f979-4666-977e-bb0667cfa48a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '39.187.89.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T06:05:06.000Z",
      "valid_until": "2026-05-08T06:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T05:23:19.309Z",
      "x_nadsec_last_seen": "2026-04-06T05:25:25.664Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56041"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-04-06T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--12b69f74-cc69-499e-930c-64f44e7df166",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '88.230.162.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T06:05:06.000Z",
      "valid_until": "2026-05-08T06:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-06T05:32:26.003Z",
      "x_nadsec_last_seen": "2026-04-06T05:39:30.462Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-06T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--0a704eea-0d10-47fd-a03a-dae52d174481",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.237.125.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T08:05:11.000Z",
      "valid_until": "2026-05-08T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T07:18:07.113Z",
      "x_nadsec_last_seen": "2026-04-19T10:55:05.201Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-06T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--cbc67404-e744-404b-aa62-ce19b895e6da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.210.81.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T08:05:11.000Z",
      "valid_until": "2026-05-08T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T07:50:59.913Z",
      "x_nadsec_last_seen": "2026-04-06T07:50:59.913Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-06T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--cd06d881-b09c-4f08-9f53-7d64a3b8af51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.10.102.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T08:05:11.000Z",
      "valid_until": "2026-05-08T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-06T08:03:44.534Z",
      "x_nadsec_last_seen": "2026-04-06T08:10:14.332Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-04-06T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--19a91643-038a-4380-884b-5b6f33c7a326",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.203.212.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T08:05:11.000Z",
      "valid_until": "2026-05-08T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-06T07:06:53.706Z",
      "x_nadsec_last_seen": "2026-04-06T07:06:54.975Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-04-06T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TN; asn=37492; asn_org=ORANGE",
      "id": "indicator--eb308426-22db-4997-a6f2-191bd0551347",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.31.52.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T08:05:11.000Z",
      "valid_until": "2026-05-08T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T07:16:10.280Z",
      "x_nadsec_last_seen": "2026-04-13T22:44:16.651Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37492"
      ],
      "x_nadsec_orgs": [
        "ORANGE"
      ]
    },
    {
      "created": "2026-04-06T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=23966; asn_org=LINKdotNET Telecom Limited",
      "id": "indicator--3678de49-0d4d-42c3-8181-b4378f681a79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '202.154.234.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T08:05:11.000Z",
      "valid_until": "2026-05-08T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T07:38:19.774Z",
      "x_nadsec_last_seen": "2026-04-06T07:40:25.061Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23966"
      ],
      "x_nadsec_orgs": [
        "LINKdotNET Telecom Limited"
      ]
    },
    {
      "created": "2026-04-06T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--fb7c450c-3ce4-4969-893d-803135f254cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.78.50.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T08:05:11.000Z",
      "valid_until": "2026-05-08T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T07:16:17.527Z",
      "x_nadsec_last_seen": "2026-04-06T07:16:17.527Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-06T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--40bd01e0-afa7-42de-ad06-fdc26292a817",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.33.199.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T08:05:11.000Z",
      "valid_until": "2026-05-08T08:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-06T07:32:35.012Z",
      "x_nadsec_last_seen": "2026-04-06T07:32:40.241Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-06T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KR; asn=17878; asn_org=DREAMMARK1",
      "id": "indicator--a61a5b9b-7035-48f0-b2f2-afd262f2a476",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '49.238.249.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T08:05:11.000Z",
      "valid_until": "2026-05-08T08:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-06T08:00:40.361Z",
      "x_nadsec_last_seen": "2026-04-17T15:26:54.857Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "17878"
      ],
      "x_nadsec_orgs": [
        "DREAMMARK1"
      ]
    },
    {
      "created": "2026-04-06T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--ecd124ed-a608-477c-bba8-12f8918d0191",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '117.7.234.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T09:05:10.000Z",
      "valid_until": "2026-05-08T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T08:37:11.339Z",
      "x_nadsec_last_seen": "2026-04-06T08:39:16.104Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-06T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f91512b7-4c6b-4650-acb5-7fec31fcb4d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.237.125.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T09:05:10.000Z",
      "valid_until": "2026-05-08T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T08:30:42.890Z",
      "x_nadsec_last_seen": "2026-04-06T08:30:42.890Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-06T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LK; asn=18001; asn_org=Dialog Axiata PLC.",
      "id": "indicator--13172bee-954f-427a-8bd3-049ecfa21dfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '175.157.22.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T09:05:10.000Z",
      "valid_until": "2026-05-08T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T08:11:15.035Z",
      "x_nadsec_last_seen": "2026-04-06T08:13:24.622Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "18001"
      ],
      "x_nadsec_orgs": [
        "Dialog Axiata PLC."
      ]
    },
    {
      "created": "2026-04-06T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=263422; asn_org=AXES SERVICOS DE COMUNICACAO LTDA.",
      "id": "indicator--67cbf654-8ac3-4bf0-a194-c6a0236ce9d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '179.191.237.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T09:05:10.000Z",
      "valid_until": "2026-05-08T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T08:06:16.418Z",
      "x_nadsec_last_seen": "2026-04-28T04:27:10.548Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "263422"
      ],
      "x_nadsec_orgs": [
        "AXES SERVICOS DE COMUNICACAO LTDA."
      ]
    },
    {
      "created": "2026-04-06T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--e83786e5-2a03-40aa-9353-8c0826c64b7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.38.249.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T09:05:10.000Z",
      "valid_until": "2026-05-08T09:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-06T08:15:10.073Z",
      "x_nadsec_last_seen": "2026-04-06T08:15:10.583Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-04-06T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=327931; asn_org=Optimum-Telecom-Algeria",
      "id": "indicator--6d6684e5-9cda-4716-99a8-33a74765e8e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.200.27.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T09:05:10.000Z",
      "valid_until": "2026-05-08T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T08:38:04.571Z",
      "x_nadsec_last_seen": "2026-04-06T08:38:12.152Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "327931"
      ],
      "x_nadsec_orgs": [
        "Optimum-Telecom-Algeria"
      ]
    },
    {
      "created": "2026-04-06T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=RU; asn=216473; asn_org=Bashinskii Vadim Ruslanovich",
      "id": "indicator--f10cbed5-d0ed-4ada-90a3-e8d99d3c5404",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '80.66.83.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T09:05:10.000Z",
      "valid_until": "2026-05-08T09:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-06T08:42:25.609Z",
      "x_nadsec_last_seen": "2026-04-25T21:45:27.509Z",
      "x_nadsec_ports": [
        "1433",
        "81",
        "135"
      ],
      "x_nadsec_services": [
        "mssqld",
        "epmapper",
        "httpd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "216473"
      ],
      "x_nadsec_orgs": [
        "Bashinskii Vadim Ruslanovich"
      ]
    },
    {
      "created": "2026-04-06T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--53d17ed0-bea3-43a7-acc7-c51f9191933a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '82.200.178.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T09:05:10.000Z",
      "valid_until": "2026-05-08T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T08:15:26.295Z",
      "x_nadsec_last_seen": "2026-04-06T08:15:32.696Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-04-06T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LK; asn=9329; asn_org=Sri Lanka Telecom Internet",
      "id": "indicator--203ae300-8c03-492b-92b1-3c1ccc48fd65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '112.134.205.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T11:05:10.000Z",
      "valid_until": "2026-05-08T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T10:48:15.425Z",
      "x_nadsec_last_seen": "2026-04-06T10:50:21.517Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "9329"
      ],
      "x_nadsec_orgs": [
        "Sri Lanka Telecom Internet"
      ]
    },
    {
      "created": "2026-04-06T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=JP; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--0e00f9da-ae75-4869-8c52-eff9e6416a59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.105.224.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T11:05:10.000Z",
      "valid_until": "2026-05-08T11:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-06T10:37:32.762Z",
      "x_nadsec_last_seen": "2026-04-20T16:14:38.833Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-06T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--5707eac2-920a-4878-b6ee-4f3c1da92462",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '183.82.116.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T11:05:10.000Z",
      "valid_until": "2026-05-08T11:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-06T10:54:12.418Z",
      "x_nadsec_last_seen": "2026-04-06T11:00:51.689Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-04-06T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--3c182840-f9d4-4d39-bdf0-decad978921d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T11:05:10.000Z",
      "valid_until": "2026-05-08T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T10:18:48.210Z",
      "x_nadsec_last_seen": "2026-04-19T00:51:20.482Z",
      "x_nadsec_ports": [
        "445",
        "1723"
      ],
      "x_nadsec_services": [
        "smbd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-06T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--96c79e95-37ce-4b27-881e-c8f1ce392f30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '101.36.106.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T12:05:11.000Z",
      "valid_until": "2026-05-08T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T11:25:48.913Z",
      "x_nadsec_last_seen": "2026-04-06T11:25:48.913Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-06T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--6a4c8379-85e8-4a2f-8754-13d3be5ec18d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.165.166.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T12:05:11.000Z",
      "valid_until": "2026-05-08T12:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-06T11:28:54.163Z",
      "x_nadsec_last_seen": "2026-04-06T11:36:04.170Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-06T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=38511; asn_org=PT Remala Abadi",
      "id": "indicator--9ae8e8e2-e817-4b11-8f1d-28b407a6e4e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '115.124.75.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T12:05:11.000Z",
      "valid_until": "2026-05-08T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T12:04:49.533Z",
      "x_nadsec_last_seen": "2026-04-06T12:06:53.780Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "38511"
      ],
      "x_nadsec_orgs": [
        "PT Remala Abadi"
      ]
    },
    {
      "created": "2026-04-06T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=265204; asn_org=LINKFIRE TELECOM LTDA",
      "id": "indicator--8cfa98f0-413b-4b09-bf8a-f497b1017bd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '167.250.66.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T12:05:11.000Z",
      "valid_until": "2026-05-08T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T11:32:26.471Z",
      "x_nadsec_last_seen": "2026-04-06T11:34:33.496Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "265204"
      ],
      "x_nadsec_orgs": [
        "LINKFIRE TELECOM LTDA"
      ]
    },
    {
      "created": "2026-04-06T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ff9ab470-740c-49a1-80e0-e62712c1e3b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.202.117.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T12:05:11.000Z",
      "valid_until": "2026-05-08T12:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-06T11:36:11.469Z",
      "x_nadsec_last_seen": "2026-04-06T11:36:11.818Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-06T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KH; asn=45498; asn_org=SMART AXIATA Co., Ltd.",
      "id": "indicator--d34049a2-d19c-457a-afd9-f2c74c65b975",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '202.93.153.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T12:05:11.000Z",
      "valid_until": "2026-05-08T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T11:40:58.022Z",
      "x_nadsec_last_seen": "2026-04-06T11:43:03.113Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KH"
      ],
      "x_nadsec_asns": [
        "45498"
      ],
      "x_nadsec_orgs": [
        "SMART AXIATA Co., Ltd."
      ]
    },
    {
      "created": "2026-04-06T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--862e4ce1-f825-44c8-ab48-c70fdc504820",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '60.249.207.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T12:05:11.000Z",
      "valid_until": "2026-05-08T12:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-06T11:34:42.305Z",
      "x_nadsec_last_seen": "2026-04-06T11:34:42.449Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-06T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--032578bc-df4e-45c3-a403-f8d0882bee16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '78.37.28.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T12:05:11.000Z",
      "valid_until": "2026-05-08T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T11:23:31.242Z",
      "x_nadsec_last_seen": "2026-04-06T11:25:37.966Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-06T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=70; services=mysqld; ports=3306; cc=IN; asn=135175; asn_org=Facts Online Pvt Ltd; user(top)=r**t",
      "id": "indicator--9726c8f5-1a13-40ed-986d-fed588a0d099",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.61.72.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T13:05:10.000Z",
      "valid_until": "2026-05-08T13:05:09.000Z",
      "x_nadsec_event_count": 70,
      "x_nadsec_first_seen": "2026-04-06T13:00:47.017Z",
      "x_nadsec_last_seen": "2026-04-06T13:01:41.265Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135175"
      ],
      "x_nadsec_orgs": [
        "Facts Online Pvt Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-06T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--c2d7370b-ff37-4079-b44b-f942c85e5a03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.104.11.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T13:05:10.000Z",
      "valid_until": "2026-05-08T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T12:05:15.377Z",
      "x_nadsec_last_seen": "2026-04-30T12:54:26.491Z",
      "x_nadsec_ports": [
        "81",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-06T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--93a1c5f3-25f3-4a04-a665-53579fc27577",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.180.141.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T13:05:10.000Z",
      "valid_until": "2026-05-08T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T12:21:58.629Z",
      "x_nadsec_last_seen": "2026-04-06T12:21:58.629Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-04-06T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--c5d9027a-28de-4a83-ba19-e4cfd90681ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.199.122.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T13:05:10.000Z",
      "valid_until": "2026-05-08T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T12:24:03.276Z",
      "x_nadsec_last_seen": "2026-04-06T12:24:03.276Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-06T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4da362df-5a80-4d30-b6fe-f23ab2dcde4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.163.58.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T13:05:10.000Z",
      "valid_until": "2026-05-08T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-06T12:49:49.679Z",
      "x_nadsec_last_seen": "2026-04-06T12:49:50.264Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-06T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=20978; asn_org=TT Mobil Iletisim Hizmetleri A.S",
      "id": "indicator--25bb8803-839a-4224-9b1a-8056aed16be8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.104.76.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T13:05:10.000Z",
      "valid_until": "2026-05-08T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T12:49:56.742Z",
      "x_nadsec_last_seen": "2026-04-06T12:52:03.648Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "20978"
      ],
      "x_nadsec_orgs": [
        "TT Mobil Iletisim Hizmetleri A.S"
      ]
    },
    {
      "created": "2026-04-06T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=34; services=mongod; ports=27017; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--cc58c595-e6a1-4507-9e17-6e9ec82cdc93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '50.116.17.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T13:05:10.000Z",
      "valid_until": "2026-05-08T13:05:09.000Z",
      "x_nadsec_event_count": 34,
      "x_nadsec_first_seen": "2026-04-06T12:31:59.051Z",
      "x_nadsec_last_seen": "2026-04-06T12:32:54.155Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-06T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--22365f69-1d12-48f5-ada1-099ff02833b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T13:05:10.000Z",
      "valid_until": "2026-05-08T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T12:09:07.193Z",
      "x_nadsec_last_seen": "2026-04-20T14:13:06.537Z",
      "x_nadsec_ports": [
        "445",
        "135",
        "1723"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-06T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--8dad4109-4a58-4fd8-b61c-b863b34d0373",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T13:05:10.000Z",
      "valid_until": "2026-05-08T13:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-06T12:10:55.010Z",
      "x_nadsec_last_seen": "2026-04-28T01:33:44.524Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-06T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--454cea9a-3d86-4097-96e6-97a9db62cff1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T13:05:10.000Z",
      "valid_until": "2026-05-08T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-06T12:31:30.851Z",
      "x_nadsec_last_seen": "2026-04-12T13:30:54.570Z",
      "x_nadsec_ports": [
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-06T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=ES; asn=57269; asn_org=Digi Spain Telecom S.A",
      "id": "indicator--ca275b47-1c30-43ce-ae88-960d62e31616",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.112.23.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T13:05:10.000Z",
      "valid_until": "2026-05-08T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T12:55:51.803Z",
      "x_nadsec_last_seen": "2026-04-06T12:55:51.803Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "57269"
      ],
      "x_nadsec_orgs": [
        "Digi Spain Telecom S.A"
      ]
    },
    {
      "created": "2026-04-06T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=29456; asn_org=Rostelecom",
      "id": "indicator--4ea9d4b7-18b4-45e1-8264-8fa38306a1fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '82.151.115.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T13:05:10.000Z",
      "valid_until": "2026-05-08T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T12:53:40.425Z",
      "x_nadsec_last_seen": "2026-04-06T12:55:47.182Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "29456"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-06T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=59420; asn_org=Medical Information Analityc Center of Kirov Region, Public Company",
      "id": "indicator--d66c4970-9e28-459b-a9c8-bc1b15f277de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.240.162.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T13:05:10.000Z",
      "valid_until": "2026-05-08T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T12:50:02.198Z",
      "x_nadsec_last_seen": "2026-04-06T12:50:02.198Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "59420"
      ],
      "x_nadsec_orgs": [
        "Medical Information Analityc Center of Kirov Region, Public Company"
      ]
    },
    {
      "created": "2026-04-06T14:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--c4a03e1b-750e-4f13-8e74-a80ff242144a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T14:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.241.139.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T14:05:22.000Z",
      "valid_until": "2026-05-08T14:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-06T13:22:11.710Z",
      "x_nadsec_last_seen": "2026-04-06T13:24:18.176Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-04-06T14:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PS; asn=12975; asn_org=Palestine Telecommunications Company (PALTEL)",
      "id": "indicator--dd361783-959a-4618-9b54-98871cbb828a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T14:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '213.6.65.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T14:05:22.000Z",
      "valid_until": "2026-05-08T14:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-04-06T13:47:35.784Z",
      "x_nadsec_last_seen": "2026-04-16T03:58:02.904Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PS"
      ],
      "x_nadsec_asns": [
        "12975"
      ],
      "x_nadsec_orgs": [
        "Palestine Telecommunications Company (PALTEL)"
      ]
    },
    {
      "created": "2026-04-06T14:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--807ce508-98da-4f29-9dee-aead1c4e0882",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T14:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T14:05:22.000Z",
      "valid_until": "2026-05-08T14:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-06T13:23:59.506Z",
      "x_nadsec_last_seen": "2026-04-28T05:20:41.529Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-06T14:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--44e169d3-7c63-4dcf-b5c2-f149bf99dccc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T14:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T14:05:22.000Z",
      "valid_until": "2026-05-08T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T13:14:01.030Z",
      "x_nadsec_last_seen": "2026-04-06T13:14:01.030Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-06T14:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--6ed0b03f-9f13-40e2-90f1-21a17e0fd3f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T14:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.33.5.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T14:05:22.000Z",
      "valid_until": "2026-05-08T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T13:29:19.696Z",
      "x_nadsec_last_seen": "2026-04-06T13:29:19.696Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-06T14:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=34; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--fd175d29-7cf8-46e7-910f-0ca7209ba448",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T14:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.227.91.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T14:05:22.000Z",
      "valid_until": "2026-05-08T14:05:09.000Z",
      "x_nadsec_event_count": 34,
      "x_nadsec_first_seen": "2026-04-06T13:33:50.122Z",
      "x_nadsec_last_seen": "2026-04-06T13:34:44.514Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-06T14:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--48861b80-2455-458f-81ff-c2946c953bfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T14:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T14:05:22.000Z",
      "valid_until": "2026-05-08T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T13:53:56.490Z",
      "x_nadsec_last_seen": "2026-04-29T03:31:24.281Z",
      "x_nadsec_ports": [
        "1723",
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "pptpd",
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-06T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--0727c00a-7ac3-4d3c-af6d-c2a51c395487",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '123.23.72.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:05:10.000Z",
      "valid_until": "2026-05-08T15:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-06T14:52:37.745Z",
      "x_nadsec_last_seen": "2026-04-06T14:57:17.410Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-06T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--b9c21eeb-b5ca-4bfc-a761-28211ad20058",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.241.78.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:05:10.000Z",
      "valid_until": "2026-05-08T15:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-06T15:02:40.908Z",
      "x_nadsec_last_seen": "2026-04-06T15:09:30.497Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-06T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--3b6853a3-2809-4411-9201-484ca36ac8ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.86.127.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:05:10.000Z",
      "valid_until": "2026-05-08T15:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-06T14:20:49.827Z",
      "x_nadsec_last_seen": "2026-04-06T14:20:49.984Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-04-06T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--a66b6dbb-7a7f-4ea5-babe-ea42e39ed2ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:05:10.000Z",
      "valid_until": "2026-05-08T15:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T14:48:43.468Z",
      "x_nadsec_last_seen": "2026-04-06T14:48:43.468Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-06T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PE; asn=27843; asn_org=WIN EMPRESAS S.A.C.",
      "id": "indicator--6cd046dc-bc0a-4d4e-82a2-33ca6861923b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.12.77.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:05:10.000Z",
      "valid_until": "2026-05-08T15:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T14:15:12.590Z",
      "x_nadsec_last_seen": "2026-04-06T14:26:36.978Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "27843"
      ],
      "x_nadsec_orgs": [
        "WIN EMPRESAS S.A.C."
      ]
    },
    {
      "created": "2026-04-06T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=UZ; asn=8193; asn_org=Uzbektelekom Joint Stock Company; user(top)=**; pass(top)=1****3",
      "id": "indicator--a862bd4e-6565-4dfb-822d-5055275c86c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.158.4.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:05:10.000Z",
      "valid_until": "2026-05-08T15:05:08.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-04-06T14:53:21.904Z",
      "x_nadsec_last_seen": "2026-04-06T14:53:29.005Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "UZ"
      ],
      "x_nadsec_asns": [
        "8193"
      ],
      "x_nadsec_orgs": [
        "Uzbektelekom Joint Stock Company"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****3"
      ]
    },
    {
      "created": "2026-04-06T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--2a1b6318-1d31-4355-8d12-1959b9c51f79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.219.0.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:05:10.000Z",
      "valid_until": "2026-05-08T15:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-06T14:10:51.318Z",
      "x_nadsec_last_seen": "2026-04-06T14:17:54.602Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-06T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--427aca0b-6ce5-4c74-8e16-d740338fe8b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '212.164.61.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:05:10.000Z",
      "valid_until": "2026-05-08T15:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T14:26:25.222Z",
      "x_nadsec_last_seen": "2026-04-06T14:28:32.400Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-06T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=38769; asn_org=PT. Bit Technology Nusantara",
      "id": "indicator--fcffa55b-f9fc-4d0e-af0c-2b1b703dbc09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '43.230.28.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:05:10.000Z",
      "valid_until": "2026-05-08T15:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-06T14:09:20.130Z",
      "x_nadsec_last_seen": "2026-04-06T14:09:46.854Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "38769"
      ],
      "x_nadsec_orgs": [
        "PT. Bit Technology Nusantara"
      ]
    },
    {
      "created": "2026-04-06T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8eb2264c-3b5c-424a-bfda-7f81cfecb89f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:05:10.000Z",
      "valid_until": "2026-05-08T15:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T14:32:27.527Z",
      "x_nadsec_last_seen": "2026-04-06T14:32:27.527Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-06T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--0d5389df-6292-4369-a4eb-14062f5e6478",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:05:10.000Z",
      "valid_until": "2026-05-08T15:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-06T14:31:32.196Z",
      "x_nadsec_last_seen": "2026-04-15T10:31:22.434Z",
      "x_nadsec_ports": [
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-06T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--cc15a2a0-e7d0-4958-93fd-5109b8ef3183",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '78.190.244.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:05:10.000Z",
      "valid_until": "2026-05-08T15:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-06T14:07:59.614Z",
      "x_nadsec_last_seen": "2026-04-06T14:17:48.478Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-06T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=UZ; asn=34718; asn_org=ist Telekom Jv LLC; user(top)=**",
      "id": "indicator--5badeb8d-922a-4c3e-b14a-b46cae8ea2a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '80.80.212.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:05:10.000Z",
      "valid_until": "2026-05-08T15:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T14:49:12.105Z",
      "x_nadsec_last_seen": "2026-04-06T14:49:12.105Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "UZ"
      ],
      "x_nadsec_asns": [
        "34718"
      ],
      "x_nadsec_orgs": [
        "ist Telekom Jv LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-06T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=26; services=smbd; ports=445; cc=KE; asn=328987; asn_org=LESL-AS",
      "id": "indicator--a392520f-5ab5-4858-bf71-7a186c5a34df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.206.113.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T16:05:10.000Z",
      "valid_until": "2026-05-08T16:05:09.000Z",
      "x_nadsec_event_count": 3151,
      "x_nadsec_first_seen": "2026-04-06T16:02:43.454Z",
      "x_nadsec_last_seen": "2026-04-06T16:54:09.987Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "328987"
      ],
      "x_nadsec_orgs": [
        "LESL-AS"
      ]
    },
    {
      "created": "2026-04-06T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--f83b8802-eb7f-4326-be87-510aee4963fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.241.157.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T16:05:10.000Z",
      "valid_until": "2026-05-08T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T15:43:15.280Z",
      "x_nadsec_last_seen": "2026-04-06T15:45:20.124Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-06T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--775d5014-4ef4-467c-917b-486faf1085ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T16:05:10.000Z",
      "valid_until": "2026-05-08T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T15:46:21.059Z",
      "x_nadsec_last_seen": "2026-04-06T15:46:21.059Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-06T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--054fe566-d125-4b8a-8fb1-e34e50acbc4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.97.5.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T16:05:10.000Z",
      "valid_until": "2026-05-08T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T15:13:03.636Z",
      "x_nadsec_last_seen": "2026-04-06T15:13:03.636Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-06T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PE; asn=6147; asn_org=INTEGRATEL PERU S.A.A.",
      "id": "indicator--14656e7d-a050-459c-b53c-fbb103977f3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.237.169.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T16:05:10.000Z",
      "valid_until": "2026-05-08T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T15:26:11.196Z",
      "x_nadsec_last_seen": "2026-04-06T15:28:18.266Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "6147"
      ],
      "x_nadsec_orgs": [
        "INTEGRATEL PERU S.A.A."
      ]
    },
    {
      "created": "2026-04-06T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=29076; asn_org=Citytelecom LLC",
      "id": "indicator--fa56ba50-6a05-43dc-9b64-1fb8621cb488",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '31.28.9.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T16:05:10.000Z",
      "valid_until": "2026-05-08T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-06T15:23:56.248Z",
      "x_nadsec_last_seen": "2026-04-06T15:23:56.316Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "29076"
      ],
      "x_nadsec_orgs": [
        "Citytelecom LLC"
      ]
    },
    {
      "created": "2026-04-06T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--4a16580f-1cd8-4b29-ac2c-c385f827e070",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.195.138.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T16:05:10.000Z",
      "valid_until": "2026-05-08T16:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-06T15:31:31.655Z",
      "x_nadsec_last_seen": "2026-04-29T09:50:58.972Z",
      "x_nadsec_ports": [
        "445",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-06T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PE; asn=265691; asn_org=WI-NET TELECOM S.A.C.; user(top)=**",
      "id": "indicator--ef768eaf-2b17-4307-8a1f-e8c7cd3c1f58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '38.25.30.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T16:05:10.000Z",
      "valid_until": "2026-05-08T16:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-06T15:15:24.005Z",
      "x_nadsec_last_seen": "2026-04-28T06:09:18.649Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "265691"
      ],
      "x_nadsec_orgs": [
        "WI-NET TELECOM S.A.C."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-06T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CY; asn=209847; asn_org=WorkTitans B.V.; user(top)=**",
      "id": "indicator--42cabd17-944d-4c43-afa2-fab9f419e27a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.12.142.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T16:05:10.000Z",
      "valid_until": "2026-05-08T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T15:26:12.636Z",
      "x_nadsec_last_seen": "2026-04-06T15:26:12.636Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CY"
      ],
      "x_nadsec_asns": [
        "209847"
      ],
      "x_nadsec_orgs": [
        "WorkTitans B.V."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-06T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--9cc4beb9-0a62-4e27-8e65-07a4e65df157",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T16:05:10.000Z",
      "valid_until": "2026-05-08T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T15:56:49.090Z",
      "x_nadsec_last_seen": "2026-04-06T15:56:49.090Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-06T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--b7c75101-9c5e-4ca1-be10-fc2cb1fb984a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T16:05:10.000Z",
      "valid_until": "2026-05-08T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T15:56:33.848Z",
      "x_nadsec_last_seen": "2026-04-06T15:56:33.848Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-06T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8402; asn_org=PVimpelCom",
      "id": "indicator--843e48b7-eca7-4170-94eb-61ba2a17f144",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '95.26.220.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T16:05:10.000Z",
      "valid_until": "2026-05-08T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T15:05:11.748Z",
      "x_nadsec_last_seen": "2026-04-06T15:07:19.730Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8402"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-04-06T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--29ffa2c7-99cc-4f30-a491-ea34a082a7ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.70.129.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T17:05:11.000Z",
      "valid_until": "2026-05-08T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T16:35:42.974Z",
      "x_nadsec_last_seen": "2026-04-06T16:37:48.352Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-04-06T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=VN; asn=38731; asn_org=CHT Compamy Ltd; user(top)=**",
      "id": "indicator--75dff00f-72c4-44d7-9887-7228de34b441",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '125.212.198.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T17:05:11.000Z",
      "valid_until": "2026-05-08T17:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-06T16:17:45.671Z",
      "x_nadsec_last_seen": "2026-04-26T09:17:42.220Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "38731"
      ],
      "x_nadsec_orgs": [
        "CHT Compamy Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-06T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MX; asn=8151; asn_org=UNINET; user(top)=**",
      "id": "indicator--f05a94e1-d99c-4837-895c-c11409e85917",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '187.212.193.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T17:05:11.000Z",
      "valid_until": "2026-05-08T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T17:00:04.246Z",
      "x_nadsec_last_seen": "2026-04-06T17:00:04.246Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-06T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CL; asn=27901; asn_org=Pacifico Cable SPA.",
      "id": "indicator--aacdff97-bd53-4bd8-96a3-ff2d8f272549",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.110.160.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T17:05:11.000Z",
      "valid_until": "2026-05-08T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-06T16:30:34.540Z",
      "x_nadsec_last_seen": "2026-04-06T16:37:50.312Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "27901"
      ],
      "x_nadsec_orgs": [
        "Pacifico Cable SPA."
      ]
    },
    {
      "created": "2026-04-06T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH",
      "id": "indicator--9a066d45-81a5-426e-93cd-60a71731790b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T17:05:11.000Z",
      "valid_until": "2026-05-08T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T16:13:44.851Z",
      "x_nadsec_last_seen": "2026-04-06T16:13:44.851Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "215778"
      ],
      "x_nadsec_orgs": [
        "Alpha Strike Labs GmbH"
      ]
    },
    {
      "created": "2026-04-06T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--2ec7e17b-3a96-4e67-8458-3fcc42ecf778",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T17:05:11.000Z",
      "valid_until": "2026-05-08T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T16:42:51.567Z",
      "x_nadsec_last_seen": "2026-04-06T16:42:51.567Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-06T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--55a96ce6-beee-4af2-9679-a4b95c2d0183",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T17:05:11.000Z",
      "valid_until": "2026-05-08T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T16:11:45.459Z",
      "x_nadsec_last_seen": "2026-04-06T16:11:45.459Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-06T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--17e1fa2f-36b0-460b-ada1-fe74eccf0a93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '206.189.239.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T17:05:11.000Z",
      "valid_until": "2026-05-08T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T16:08:01.150Z",
      "x_nadsec_last_seen": "2026-04-06T16:08:01.150Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-06T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=UA; asn=34814; asn_org=Osnova-Internet LLC",
      "id": "indicator--4e30afc1-82c2-478e-ac8c-917f8e91f977",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.149.91.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T17:05:11.000Z",
      "valid_until": "2026-05-08T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T17:01:06.344Z",
      "x_nadsec_last_seen": "2026-04-06T17:01:12.326Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "34814"
      ],
      "x_nadsec_orgs": [
        "Osnova-Internet LLC"
      ]
    },
    {
      "created": "2026-04-06T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=57334; asn_org=SPB State Unitary Enterprise ATS Smolnogo",
      "id": "indicator--2d1b2fd1-c765-4aee-b9e4-ad51a82d394f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.183.29.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T17:05:11.000Z",
      "valid_until": "2026-05-08T17:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-06T16:56:53.568Z",
      "x_nadsec_last_seen": "2026-04-06T17:03:00.324Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "57334"
      ],
      "x_nadsec_orgs": [
        "SPB State Unitary Enterprise ATS Smolnogo"
      ]
    },
    {
      "created": "2026-04-06T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--9b827778-fd56-4b6e-8c57-45aa88396c28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.183.45.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T17:05:11.000Z",
      "valid_until": "2026-05-08T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T16:08:00.280Z",
      "x_nadsec_last_seen": "2026-04-06T16:08:00.280Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-06T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ES; asn=3352; asn_org=Telefonica De Espana S.a.u.",
      "id": "indicator--05678bc0-3cb5-4f1d-ace2-6f6aca45cbd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.153.74.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T17:05:11.000Z",
      "valid_until": "2026-05-08T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T16:17:29.420Z",
      "x_nadsec_last_seen": "2026-04-06T16:19:35.666Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "3352"
      ],
      "x_nadsec_orgs": [
        "Telefonica De Espana S.a.u."
      ]
    },
    {
      "created": "2026-04-06T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=NL; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--95e132dc-a777-46da-bfb1-662341a5408b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.102.49.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T17:05:11.000Z",
      "valid_until": "2026-05-08T17:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-04-06T16:07:26.535Z",
      "x_nadsec_last_seen": "2026-04-18T13:25:30.977Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-04-06T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PE; asn=262210; asn_org=VIETTEL PERU S.A.C.",
      "id": "indicator--677efede-348a-4d57-9430-37206c4360b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '181.176.136.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T18:05:10.000Z",
      "valid_until": "2026-05-08T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T17:56:41.410Z",
      "x_nadsec_last_seen": "2026-04-06T17:58:56.995Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "262210"
      ],
      "x_nadsec_orgs": [
        "VIETTEL PERU S.A.C."
      ]
    },
    {
      "created": "2026-04-06T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.",
      "id": "indicator--60f1c35e-b540-475a-8030-bc5354a88165",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.109.6.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T18:05:10.000Z",
      "valid_until": "2026-05-08T18:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-06T17:10:46.391Z",
      "x_nadsec_last_seen": "2026-04-06T17:18:07.610Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7303"
      ],
      "x_nadsec_orgs": [
        "Telecom Argentina S.A."
      ]
    },
    {
      "created": "2026-04-06T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--3c6675ed-ed5a-4883-a5c1-b2cf7de786ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.201.238.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T18:05:10.000Z",
      "valid_until": "2026-05-08T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T17:52:47.241Z",
      "x_nadsec_last_seen": "2026-04-06T17:54:53.853Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-04-06T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--505e3d39-98d6-4ff7-91f6-1ded54c8dcd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T18:05:10.000Z",
      "valid_until": "2026-05-08T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-06T17:09:22.466Z",
      "x_nadsec_last_seen": "2026-04-29T21:31:37.455Z",
      "x_nadsec_ports": [
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-06T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--b670054a-aa88-4967-a59a-4c398f668ef2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '88.235.217.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T18:05:10.000Z",
      "valid_until": "2026-05-08T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T17:12:08.431Z",
      "x_nadsec_last_seen": "2026-04-06T17:14:22.347Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-06T19:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=GB; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--32d596f1-beb3-49b2-8155-1abf97fdb9a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T19:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.193.65.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T19:05:22.000Z",
      "valid_until": "2026-05-08T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T18:50:54.854Z",
      "x_nadsec_last_seen": "2026-04-06T18:51:14.661Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-06T19:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=52721; asn_org=TOLEDO FIBRA TELECOMUNICACAO LTDA; user(top)=**",
      "id": "indicator--56be2a38-0f04-459d-b200-f3c89735f341",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T19:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.185.108.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T19:05:22.000Z",
      "valid_until": "2026-05-08T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T18:57:54.502Z",
      "x_nadsec_last_seen": "2026-04-06T18:57:54.502Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52721"
      ],
      "x_nadsec_orgs": [
        "TOLEDO FIBRA TELECOMUNICACAO LTDA"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-06T19:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=NG; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--556d9df0-c828-4468-b02d-f0dc58d62e02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T19:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.140.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T19:05:22.000Z",
      "valid_until": "2026-05-08T19:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-06T18:11:21.576Z",
      "x_nadsec_last_seen": "2026-04-21T19:24:58.650Z",
      "x_nadsec_ports": [
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-06T19:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--ce50873a-c83a-48f1-8ed7-3cb1c101b138",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T19:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '164.92.195.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T19:05:22.000Z",
      "valid_until": "2026-05-08T19:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-04-06T18:53:29.481Z",
      "x_nadsec_last_seen": "2026-04-06T18:54:32.099Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-06T19:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--34c75046-01b0-4738-bc36-de8b477d84e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T19:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.172.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T19:05:22.000Z",
      "valid_until": "2026-05-08T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-06T18:17:35.269Z",
      "x_nadsec_last_seen": "2026-04-06T18:17:59.247Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-06T19:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--00f0aefe-5813-457e-9166-c8e483c5d346",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T19:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '167.99.140.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T19:05:22.000Z",
      "valid_until": "2026-05-08T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-06T18:54:40.001Z",
      "x_nadsec_last_seen": "2026-04-06T18:54:40.600Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-06T19:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AR; asn=11014; asn_org=CPS",
      "id": "indicator--25ee153d-78b4-45b9-b54a-cd7a23fddcc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T19:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.111.226.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T19:05:22.000Z",
      "valid_until": "2026-05-08T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T18:22:29.388Z",
      "x_nadsec_last_seen": "2026-04-30T11:54:41.078Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "11014"
      ],
      "x_nadsec_orgs": [
        "CPS"
      ]
    },
    {
      "created": "2026-04-06T19:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8492; asn_org=OBIT Ltd.",
      "id": "indicator--d4da6fde-3d0b-4975-a625-eacab734b7ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T19:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '95.161.219.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T19:05:22.000Z",
      "valid_until": "2026-05-08T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T18:55:23.859Z",
      "x_nadsec_last_seen": "2026-04-06T18:57:30.535Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8492"
      ],
      "x_nadsec_orgs": [
        "OBIT Ltd."
      ]
    },
    {
      "created": "2026-04-06T19:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--dd000465-098c-4e1f-aa4f-ac4bf841934e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T19:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '95.9.233.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T19:05:22.000Z",
      "valid_until": "2026-05-08T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T18:12:15.541Z",
      "x_nadsec_last_seen": "2026-04-06T18:14:22.115Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-06T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=35815; asn_org=LLC Cifrovie Seti Urala",
      "id": "indicator--347afb2e-2ca2-4ff0-a5a2-7904c03e87fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '109.198.109.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T20:05:10.000Z",
      "valid_until": "2026-05-08T20:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-06T19:40:58.898Z",
      "x_nadsec_last_seen": "2026-04-06T19:49:02.761Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "35815"
      ],
      "x_nadsec_orgs": [
        "LLC Cifrovie Seti Urala"
      ]
    },
    {
      "created": "2026-04-06T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=HK; asn=132839; asn_org=POWER LINE DATACENTER; user(top)=**",
      "id": "indicator--ffbddc7c-463d-4c1c-974c-e3e2a5bc1e9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '116.193.169.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T20:05:10.000Z",
      "valid_until": "2026-05-08T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T19:06:29.820Z",
      "x_nadsec_last_seen": "2026-04-06T19:06:29.820Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "132839"
      ],
      "x_nadsec_orgs": [
        "POWER LINE DATACENTER"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-06T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=SG; asn=152194; asn_org=CTG Server Limited",
      "id": "indicator--1818be5e-6ee9-4543-b501-e67562a729d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.128.47.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T20:05:10.000Z",
      "valid_until": "2026-05-08T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-06T19:37:43.159Z",
      "x_nadsec_last_seen": "2026-04-06T19:38:25.263Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "152194"
      ],
      "x_nadsec_orgs": [
        "CTG Server Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "%****%"
      ]
    },
    {
      "created": "2026-04-06T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--ec8a9e41-9f45-4cfc-b1b7-681ec3d15860",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.93.147.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T20:05:10.000Z",
      "valid_until": "2026-05-08T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T19:43:33.471Z",
      "x_nadsec_last_seen": "2026-04-06T19:43:33.471Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-06T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--7d377912-d211-4ed5-991e-eb1270b01c8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.93.7.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T20:05:10.000Z",
      "valid_until": "2026-05-08T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T20:03:52.506Z",
      "x_nadsec_last_seen": "2026-04-06T20:03:52.506Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-06T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--8e78560e-fa96-48b8-92d3-64557c1112f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.91.203.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T20:05:10.000Z",
      "valid_until": "2026-05-08T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T19:23:38.764Z",
      "x_nadsec_last_seen": "2026-04-06T19:23:45.022Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-04-06T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b3a7a6d5-c580-4dd5-8dd2-ed4bc104ab86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T20:05:10.000Z",
      "valid_until": "2026-05-08T20:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-06T19:31:01.030Z",
      "x_nadsec_last_seen": "2026-04-06T19:31:02.068Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-06T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b6de054d-6c94-43fe-a756-f437a2a00b6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.168.124.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T20:05:10.000Z",
      "valid_until": "2026-05-08T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T19:22:59.202Z",
      "x_nadsec_last_seen": "2026-04-06T19:22:59.202Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-06T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--1583c68d-a25d-47eb-8a03-39b7e69b70c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T20:05:10.000Z",
      "valid_until": "2026-05-08T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T19:18:43.482Z",
      "x_nadsec_last_seen": "2026-04-06T19:18:43.482Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-06T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--c7bdaac8-11f6-47d2-a46a-7f56f49c8487",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.143.237.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T20:05:10.000Z",
      "valid_until": "2026-05-08T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T19:59:52.024Z",
      "x_nadsec_last_seen": "2026-04-06T20:01:58.731Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-06T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29091; asn_org=IPNXng",
      "id": "indicator--3b395047-d954-4ba9-8534-9e638c0c301d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '62.173.37.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T20:05:10.000Z",
      "valid_until": "2026-05-08T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T19:35:53.287Z",
      "x_nadsec_last_seen": "2026-04-06T19:38:00.128Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29091"
      ],
      "x_nadsec_orgs": [
        "IPNXng"
      ]
    },
    {
      "created": "2026-04-06T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--6aca70a6-537f-45ae-a521-0bb2327c7072",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T20:05:10.000Z",
      "valid_until": "2026-05-08T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T19:33:00.686Z",
      "x_nadsec_last_seen": "2026-04-06T19:33:00.686Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-06T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=133661; asn_org=Netplus Broadband Services Private Limited",
      "id": "indicator--1a115460-13ea-49a6-a631-d38c19f6b640",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.66.205.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T21:05:10.000Z",
      "valid_until": "2026-05-08T21:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-06T20:17:21.887Z",
      "x_nadsec_last_seen": "2026-04-06T20:24:02.937Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133661"
      ],
      "x_nadsec_orgs": [
        "Netplus Broadband Services Private Limited"
      ]
    },
    {
      "created": "2026-04-06T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--0071acab-651f-4659-a6b5-9ad6759747ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T21:05:10.000Z",
      "valid_until": "2026-05-08T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T20:46:53.740Z",
      "x_nadsec_last_seen": "2026-04-06T20:46:53.740Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-06T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=VN; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--85f5f081-eba4-4b50-9651-df11efd8a525",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.162.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T21:05:10.000Z",
      "valid_until": "2026-05-08T21:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-06T20:11:27.048Z",
      "x_nadsec_last_seen": "2026-04-06T20:12:29.111Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-06T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=53062; asn_org=ALT | GRUPO BRASIL TECPAR",
      "id": "indicator--efdf506b-cad5-46bd-bd5c-23e77e4432e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '168.90.171.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T21:05:10.000Z",
      "valid_until": "2026-05-08T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T20:54:14.745Z",
      "x_nadsec_last_seen": "2026-04-06T20:56:21.516Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "53062"
      ],
      "x_nadsec_orgs": [
        "ALT | GRUPO BRASIL TECPAR"
      ]
    },
    {
      "created": "2026-04-06T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--51bd0d6a-3006-4eb1-bf41-40db9b00778c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.72.244.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T21:05:10.000Z",
      "valid_until": "2026-05-08T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T20:51:29.046Z",
      "x_nadsec_last_seen": "2026-04-06T20:53:34.832Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-04-06T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--39a5280f-285b-483e-b9f4-336f25b631c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T21:05:10.000Z",
      "valid_until": "2026-05-08T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T20:25:08.969Z",
      "x_nadsec_last_seen": "2026-04-06T20:25:08.969Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-06T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MO; asn=4609; asn_org=Companhia de Telecomunicacoes de Macau SARL",
      "id": "indicator--e59e9170-ff09-4546-9c92-3f99fcc30243",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '202.175.121.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T21:05:10.000Z",
      "valid_until": "2026-05-08T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T20:30:45.922Z",
      "x_nadsec_last_seen": "2026-04-06T20:32:51.224Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MO"
      ],
      "x_nadsec_asns": [
        "4609"
      ],
      "x_nadsec_orgs": [
        "Companhia de Telecomunicacoes de Macau SARL"
      ]
    },
    {
      "created": "2026-04-06T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=HK; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--f40fcd60-e4ae-4d2d-8ba9-d385d3fb2f39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '8.210.123.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T21:05:10.000Z",
      "valid_until": "2026-05-08T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T20:58:35.915Z",
      "x_nadsec_last_seen": "2026-04-06T20:58:35.915Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-06T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=24955; asn_org=JSC Ufanet",
      "id": "indicator--8eeba970-f47b-4c1a-b62c-c02bacced392",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.214.255.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T22:05:10.000Z",
      "valid_until": "2026-05-08T22:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-06T21:06:14.882Z",
      "x_nadsec_last_seen": "2026-04-06T21:13:34.012Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "24955"
      ],
      "x_nadsec_orgs": [
        "JSC Ufanet"
      ]
    },
    {
      "created": "2026-04-06T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--3fbd9ed1-d82d-44bf-a1f5-2de9d2e86401",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '187.141.123.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T22:05:10.000Z",
      "valid_until": "2026-05-08T22:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-06T22:02:23.478Z",
      "x_nadsec_last_seen": "2026-04-06T22:03:26.703Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-04-06T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=44552; asn_org=Altura ltd.",
      "id": "indicator--653b4f80-1c22-4f40-ab13-96828d97f686",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '82.114.241.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T22:05:10.000Z",
      "valid_until": "2026-05-08T22:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T21:25:57.158Z",
      "x_nadsec_last_seen": "2026-04-06T21:28:03.738Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "44552"
      ],
      "x_nadsec_orgs": [
        "Altura ltd."
      ]
    },
    {
      "created": "2026-04-06T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--e9c2c1c7-f784-425b-ba24-93d31c38d011",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '90.151.105.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T22:05:10.000Z",
      "valid_until": "2026-05-08T22:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T21:09:25.717Z",
      "x_nadsec_last_seen": "2026-04-06T21:11:32.387Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-06T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--b16eb366-7d07-42ac-a50f-b2f526dbfd0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.90.80.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T23:05:10.000Z",
      "valid_until": "2026-05-08T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T22:15:35.554Z",
      "x_nadsec_last_seen": "2026-04-06T22:17:42.225Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-06T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--817d15e6-f492-4089-aa82-851062c9e2a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '117.6.97.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T23:05:10.000Z",
      "valid_until": "2026-05-08T23:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-06T22:24:40.197Z",
      "x_nadsec_last_seen": "2026-04-06T22:40:45.396Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-06T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=SC; asn=401701; asn_org=cognetcloud INC",
      "id": "indicator--b4059861-b149-41a4-b4aa-64f90027a1f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '156.225.29.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T23:05:10.000Z",
      "valid_until": "2026-05-08T23:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-06T23:04:42.323Z",
      "x_nadsec_last_seen": "2026-04-09T14:44:16.190Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "401701"
      ],
      "x_nadsec_orgs": [
        "cognetcloud INC"
      ]
    },
    {
      "created": "2026-04-06T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--88be0642-3009-4ed9-b6f3-6c305c19f7cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '171.244.188.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T23:05:10.000Z",
      "valid_until": "2026-05-08T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T22:49:09.606Z",
      "x_nadsec_last_seen": "2026-04-06T22:51:14.239Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-06T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=26615; asn_org=TIM SA",
      "id": "indicator--f7991d3e-36fa-4d96-a156-dc192e2fb66b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.40.184.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T23:05:10.000Z",
      "valid_until": "2026-05-08T23:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-06T22:41:58.024Z",
      "x_nadsec_last_seen": "2026-04-06T22:49:14.790Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "26615"
      ],
      "x_nadsec_orgs": [
        "TIM SA"
      ]
    },
    {
      "created": "2026-04-06T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--675724a0-d86a-4aa0-8f22-1de40a0c191f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T23:05:10.000Z",
      "valid_until": "2026-05-08T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T22:40:53.213Z",
      "x_nadsec_last_seen": "2026-04-06T22:40:53.213Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-06T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--00abe1fb-a476-451d-9c8c-d6c691d41e10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T23:05:10.000Z",
      "valid_until": "2026-05-08T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T22:45:22.009Z",
      "x_nadsec_last_seen": "2026-04-06T22:45:22.009Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-06T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KH; asn=55769; asn_org=SOUTH EAST ASIA TELECOM Cambodia Co., LTD",
      "id": "indicator--2f0dbbbc-0c4a-46ae-bb0c-c4f4d8071f7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.250.238.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T23:05:10.000Z",
      "valid_until": "2026-05-08T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-06T22:20:08.139Z",
      "x_nadsec_last_seen": "2026-04-06T22:20:12.614Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KH"
      ],
      "x_nadsec_asns": [
        "55769"
      ],
      "x_nadsec_orgs": [
        "SOUTH EAST ASIA TELECOM Cambodia Co., LTD"
      ]
    },
    {
      "created": "2026-04-07T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BD; asn=137967; asn_org=Digicon Telecommunication Ltd",
      "id": "indicator--1a4f22eb-3449-4644-aa01-6e136e3e14bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '116.204.151.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T00:05:12.000Z",
      "valid_until": "2026-05-09T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-06T23:58:49.693Z",
      "x_nadsec_last_seen": "2026-04-06T23:58:49.765Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "137967"
      ],
      "x_nadsec_orgs": [
        "Digicon Telecommunication Ltd"
      ]
    },
    {
      "created": "2026-04-07T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--31602809-4f57-49d1-835b-c4cb3de999e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.198.174.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T00:05:12.000Z",
      "valid_until": "2026-05-09T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-06T23:29:02.830Z",
      "x_nadsec_last_seen": "2026-04-06T23:29:02.830Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-07T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=epmapper; ports=135; cc=AU; asn=7604; asn_org=Zettagrid Pty Ltd",
      "id": "indicator--71df28b9-7198-4873-9323-82b5423ec959",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '202.74.160.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T00:05:12.000Z",
      "valid_until": "2026-05-09T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T00:00:51.206Z",
      "x_nadsec_last_seen": "2026-04-07T00:00:51.987Z",
      "x_nadsec_ports": [
        "135",
        "445"
      ],
      "x_nadsec_services": [
        "epmapper",
        "smbd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "7604"
      ],
      "x_nadsec_orgs": [
        "Zettagrid Pty Ltd"
      ]
    },
    {
      "created": "2026-04-07T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--179489e3-a686-4b27-bb6d-30f5fc287042",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '122.54.146.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T02:05:10.000Z",
      "valid_until": "2026-05-09T02:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-07T01:22:39.424Z",
      "x_nadsec_last_seen": "2026-04-16T01:58:22.701Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-07T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--4fdc6d9a-9e3e-4ccc-9ed4-29a0faa1bb7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '171.225.193.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T02:05:10.000Z",
      "valid_until": "2026-05-09T02:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T01:39:05.971Z",
      "x_nadsec_last_seen": "2026-04-07T01:41:11.172Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-07T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--c33fd94b-24b0-4380-9ec9-cb0927367c3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.231.205.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T03:05:10.000Z",
      "valid_until": "2026-05-09T03:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T02:58:39.742Z",
      "x_nadsec_last_seen": "2026-04-07T02:58:44.737Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-07T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--4c3c4050-07ec-4729-bd12-6cfc074a1a17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '159.223.175.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T03:05:10.000Z",
      "valid_until": "2026-05-09T03:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T02:36:51.824Z",
      "x_nadsec_last_seen": "2026-04-07T02:36:51.824Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-07T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--2f9ab8a7-6cc5-4e0b-8e21-16344b8b0dab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '180.253.178.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T03:05:10.000Z",
      "valid_until": "2026-05-09T03:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T02:33:43.033Z",
      "x_nadsec_last_seen": "2026-04-07T02:35:48.058Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-07T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--fbf319e9-c5a8-4588-94c9-1eb3cecda3eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.151.7.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T03:05:10.000Z",
      "valid_until": "2026-05-09T03:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-07T03:04:36.531Z",
      "x_nadsec_last_seen": "2026-04-07T03:11:42.015Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-04-07T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--bfd4ce11-9cdf-46bc-a1f2-e2b9a447f73d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T03:05:10.000Z",
      "valid_until": "2026-05-09T03:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T02:34:35.700Z",
      "x_nadsec_last_seen": "2026-04-07T02:34:35.700Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-07T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=SE; asn=215540; asn_org=Global Connectivity Solutions Llp",
      "id": "indicator--4e259ff1-4ef1-42a5-b445-9f44f0dfc245",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.82.13.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T03:05:10.000Z",
      "valid_until": "2026-05-09T03:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T02:34:01.294Z",
      "x_nadsec_last_seen": "2026-04-11T02:31:31.288Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "NL",
        "SE"
      ],
      "x_nadsec_asns": [
        "215540"
      ],
      "x_nadsec_orgs": [
        "Global Connectivity Solutions Llp"
      ]
    },
    {
      "created": "2026-04-07T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=NL; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--42f864af-10b5-4ee6-a464-d599e56a96d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '57.153.203.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T03:05:10.000Z",
      "valid_until": "2026-05-09T03:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-07T02:55:31.930Z",
      "x_nadsec_last_seen": "2026-04-12T19:21:38.300Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-07T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--11c7e96a-5864-4a7f-a048-95c8eaa92d14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.46.235.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T04:05:09.000Z",
      "valid_until": "2026-05-09T04:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T03:51:38.793Z",
      "x_nadsec_last_seen": "2026-04-07T03:51:48.969Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-07T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=6453; asn_org=TATA COMMUNICATIONS AMERICA INC",
      "id": "indicator--42c49b1e-84b8-482c-9459-dde6136df507",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.86.152.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T04:05:09.000Z",
      "valid_until": "2026-05-09T04:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T03:47:00.554Z",
      "x_nadsec_last_seen": "2026-04-07T03:49:06.225Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6453"
      ],
      "x_nadsec_orgs": [
        "TATA COMMUNICATIONS AMERICA INC"
      ]
    },
    {
      "created": "2026-04-07T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--45f18fea-60e6-4248-9aea-b584b4816319",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T04:05:09.000Z",
      "valid_until": "2026-05-09T04:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T03:17:11.810Z",
      "x_nadsec_last_seen": "2026-04-30T12:10:45.294Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-04-07T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133278; asn_org=Dehradun Enet Solutions Private Ltd",
      "id": "indicator--bb30ac73-1c7f-4294-955d-34d93cc54ff0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.94.114.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T05:05:05.000Z",
      "valid_until": "2026-05-09T05:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T04:22:35.076Z",
      "x_nadsec_last_seen": "2026-04-07T04:22:40.826Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133278"
      ],
      "x_nadsec_orgs": [
        "Dehradun Enet Solutions Private Ltd"
      ]
    },
    {
      "created": "2026-04-07T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1129; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--18e9fe9b-a5ea-4b0d-acc9-6fe3fbcc385d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '111.249.81.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T05:05:05.000Z",
      "valid_until": "2026-05-09T05:05:03.000Z",
      "x_nadsec_event_count": 1129,
      "x_nadsec_first_seen": "2026-04-07T04:11:08.930Z",
      "x_nadsec_last_seen": "2026-04-07T04:42:42.369Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-07T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--f1c8a72b-df47-46c8-b945-c8944eae3a33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T05:05:05.000Z",
      "valid_until": "2026-05-09T05:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-07T04:29:41.527Z",
      "x_nadsec_last_seen": "2026-04-29T22:53:42.003Z",
      "x_nadsec_ports": [
        "21",
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-07T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=12735; asn_org=TurkNet Iletisim Hizmetleri A.S.",
      "id": "indicator--4b491305-5ec5-4610-91dc-5d5af5523af7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '212.154.96.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T05:05:05.000Z",
      "valid_until": "2026-05-09T05:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T04:53:44.135Z",
      "x_nadsec_last_seen": "2026-04-07T04:55:50.418Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "12735"
      ],
      "x_nadsec_orgs": [
        "TurkNet Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-04-07T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=NL; asn=1136; asn_org=KPN B.V.",
      "id": "indicator--8ad4b8f6-cbe9-4cab-a721-4bee72ec1068",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '77.60.231.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T05:05:05.000Z",
      "valid_until": "2026-05-09T05:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T04:53:43.447Z",
      "x_nadsec_last_seen": "2026-04-12T08:06:09.460Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "1136"
      ],
      "x_nadsec_orgs": [
        "KPN B.V."
      ]
    },
    {
      "created": "2026-04-07T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--0566bbe9-da0a-4c85-95f8-d224f83debbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '88.253.7.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T05:05:05.000Z",
      "valid_until": "2026-05-09T05:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-07T04:35:08.849Z",
      "x_nadsec_last_seen": "2026-04-07T04:42:17.965Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-07T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=21487; asn_org=Rostelecom",
      "id": "indicator--2c7786b8-ebac-482b-8153-b4fe6bda475b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.185.251.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T05:05:05.000Z",
      "valid_until": "2026-05-09T05:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-02T17:50:26.653Z",
      "x_nadsec_last_seen": "2026-04-07T04:11:36.354Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "21487"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-07T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17625; asn_org=BlazeNets Network",
      "id": "indicator--40a6c8a8-1234-4143-a5b7-ebe559e1ea55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.104.227.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T06:05:10.000Z",
      "valid_until": "2026-05-09T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T05:50:26.716Z",
      "x_nadsec_last_seen": "2026-04-07T05:52:31.395Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17625"
      ],
      "x_nadsec_orgs": [
        "BlazeNets Network"
      ]
    },
    {
      "created": "2026-04-07T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BD; asn=135353; asn_org=MD SHIRAJUL HAIDER TA Cue Club Technology; user(top)=**",
      "id": "indicator--4c1378f5-e430-494b-b40a-86e0e9e5463a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.214.219.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T06:05:10.000Z",
      "valid_until": "2026-05-09T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-07T05:30:14.330Z",
      "x_nadsec_last_seen": "2026-04-22T05:02:16.634Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "135353"
      ],
      "x_nadsec_orgs": [
        "MD SHIRAJUL HAIDER TA Cue Club Technology"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-07T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--9226a66c-397b-415e-bfff-c36bed92b0df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.161.150.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T06:05:10.000Z",
      "valid_until": "2026-05-09T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T05:17:40.535Z",
      "x_nadsec_last_seen": "2026-04-07T05:17:40.535Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-07T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--9a5a67b6-68a9-474c-bbdf-e5ca03303cfb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.69.53.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T06:05:10.000Z",
      "valid_until": "2026-05-09T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-07T05:14:44.553Z",
      "x_nadsec_last_seen": "2026-04-07T05:18:12.269Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-04-07T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--090915bd-156f-49f9-987b-e2b0d93c666b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.195.54.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T06:05:10.000Z",
      "valid_until": "2026-05-09T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T05:38:12.138Z",
      "x_nadsec_last_seen": "2026-04-07T05:40:17.196Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-04-07T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--89bba386-bd7f-4816-895b-ee823d1c8329",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.248.172.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T06:05:10.000Z",
      "valid_until": "2026-05-09T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T05:20:49.141Z",
      "x_nadsec_last_seen": "2026-04-07T05:22:53.864Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-07T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=GB; asn=215540; asn_org=Global Connectivity Solutions Llp",
      "id": "indicator--994b6c50-b956-4c8c-aab5-b6b6b588c204",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.45.179.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T06:05:10.000Z",
      "valid_until": "2026-05-09T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T05:14:02.889Z",
      "x_nadsec_last_seen": "2026-04-07T05:14:02.889Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "215540"
      ],
      "x_nadsec_orgs": [
        "Global Connectivity Solutions Llp"
      ]
    },
    {
      "created": "2026-04-07T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=132298; asn_org=Antaranga Dot Com Ltd",
      "id": "indicator--84a6f364-ce1d-4da7-b8db-05934c30ab47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '160.202.146.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T06:05:10.000Z",
      "valid_until": "2026-05-09T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T05:28:41.092Z",
      "x_nadsec_last_seen": "2026-04-07T05:30:46.090Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "132298"
      ],
      "x_nadsec_orgs": [
        "Antaranga Dot Com Ltd"
      ]
    },
    {
      "created": "2026-04-07T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--bed6834a-8c95-4657-bb76-c81d855ead01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '180.243.109.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T06:05:10.000Z",
      "valid_until": "2026-05-09T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-07T05:18:08.540Z",
      "x_nadsec_last_seen": "2026-04-07T05:24:38.473Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-07T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PE; asn=6147; asn_org=INTEGRATEL PERU S.A.A.",
      "id": "indicator--96d51bc3-c04f-4980-9730-936a7273149c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '181.67.238.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T06:05:10.000Z",
      "valid_until": "2026-05-09T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T05:35:20.062Z",
      "x_nadsec_last_seen": "2026-04-07T05:35:20.131Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "6147"
      ],
      "x_nadsec_orgs": [
        "INTEGRATEL PERU S.A.A."
      ]
    },
    {
      "created": "2026-04-07T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=50254; asn_org=Sky Engineering LLC",
      "id": "indicator--5fa95662-9df4-4219-8554-587906be5c10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.145.124.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T06:05:10.000Z",
      "valid_until": "2026-05-09T06:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-07T06:03:44.121Z",
      "x_nadsec_last_seen": "2026-04-11T10:15:59.254Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "50254"
      ],
      "x_nadsec_orgs": [
        "Sky Engineering LLC"
      ]
    },
    {
      "created": "2026-04-07T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=UZ; asn=49273; asn_org=COSCOM Liability Limited Company",
      "id": "indicator--0b24f92f-8351-4e3a-89e7-020e1e4c9363",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '188.113.208.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T06:05:10.000Z",
      "valid_until": "2026-05-09T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T05:14:34.376Z",
      "x_nadsec_last_seen": "2026-04-07T05:27:54.409Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UZ"
      ],
      "x_nadsec_asns": [
        "49273"
      ],
      "x_nadsec_orgs": [
        "COSCOM Liability Limited Company"
      ]
    },
    {
      "created": "2026-04-07T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--def9891e-98c7-40be-9a6b-97b4651e252a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.171.8.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T06:05:10.000Z",
      "valid_until": "2026-05-09T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T05:19:09.269Z",
      "x_nadsec_last_seen": "2026-04-15T10:07:25.977Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-07T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=NL; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--23b6403f-6741-46f0-9590-ca362e7e67bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.95.147.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T06:05:10.000Z",
      "valid_until": "2026-05-09T06:05:09.000Z",
      "x_nadsec_event_count": 95,
      "x_nadsec_first_seen": "2026-04-07T05:29:41.717Z",
      "x_nadsec_last_seen": "2026-04-13T23:02:31.833Z",
      "x_nadsec_ports": [
        "445",
        "1723",
        "21",
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "pptpd",
        "ftpd",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-04-07T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=55577; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--d33a0d3a-ca4f-48b5-bb16-26dcb10eaa8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '49.205.117.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T06:05:10.000Z",
      "valid_until": "2026-05-09T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T06:00:49.385Z",
      "x_nadsec_last_seen": "2026-04-07T06:02:54.686Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55577"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-04-07T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=17762; asn_org=Tata Teleservices Maharashtra Ltd",
      "id": "indicator--3403d14d-9599-4bcc-be63-a26dd910b102",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '49.248.9.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T06:05:10.000Z",
      "valid_until": "2026-05-09T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-07T05:58:18.309Z",
      "x_nadsec_last_seen": "2026-04-07T05:59:07.621Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17762"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices Maharashtra Ltd"
      ]
    },
    {
      "created": "2026-04-07T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--609281d0-12b3-46df-a80a-1d40a8680dc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T06:05:10.000Z",
      "valid_until": "2026-05-09T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T05:35:20.252Z",
      "x_nadsec_last_seen": "2026-04-28T16:37:31.138Z",
      "x_nadsec_ports": [
        "445",
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-07T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--7bb558a1-b9a9-4f84-ba46-34daa3cb0cb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '88.255.224.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T06:05:10.000Z",
      "valid_until": "2026-05-09T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T05:20:54.008Z",
      "x_nadsec_last_seen": "2026-04-07T05:23:00.592Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-07T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f217f836-67cd-4571-8cb4-3716e5930880",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.237.125.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T07:05:09.000Z",
      "valid_until": "2026-05-09T07:05:07.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T06:13:41.122Z",
      "x_nadsec_last_seen": "2026-04-07T06:13:51.309Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-07T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--995b102a-0b39-4b4f-bd88-6174fc74caae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.191.122.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T07:05:09.000Z",
      "valid_until": "2026-05-09T07:05:07.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-04-07T06:25:38.864Z",
      "x_nadsec_last_seen": "2026-04-07T06:27:55.578Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-07T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--dc0ff5d4-ea60-4603-9784-80d8d18efe1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.99.171.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T07:05:09.000Z",
      "valid_until": "2026-05-09T07:05:07.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T06:52:45.574Z",
      "x_nadsec_last_seen": "2026-04-07T06:54:50.416Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-04-07T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=52838; asn_org=WN TELECOM LTDA - ME",
      "id": "indicator--2e73308b-4711-4551-94a3-71abef6a6a20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '177.66.101.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T07:05:09.000Z",
      "valid_until": "2026-05-09T07:05:07.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T06:23:25.915Z",
      "x_nadsec_last_seen": "2026-04-07T06:25:32.856Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52838"
      ],
      "x_nadsec_orgs": [
        "WN TELECOM LTDA - ME"
      ]
    },
    {
      "created": "2026-04-07T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--8b439d43-994a-485c-a1a8-ea03283015e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '180.252.225.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T07:05:09.000Z",
      "valid_until": "2026-05-09T07:05:07.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-07T06:58:06.022Z",
      "x_nadsec_last_seen": "2026-04-07T07:02:22.294Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-07T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--84c1d824-d63c-41eb-a989-949fb6e5c381",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.227.15.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T07:05:09.000Z",
      "valid_until": "2026-05-09T07:05:07.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T06:23:42.766Z",
      "x_nadsec_last_seen": "2026-04-07T06:23:42.766Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-07T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=63878; asn_org=PT Victory Network Indonesia",
      "id": "indicator--b3e5d837-a24f-41cc-ac62-cfe04683bb18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.236.189.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T08:05:10.000Z",
      "valid_until": "2026-05-09T08:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-07T07:55:51.701Z",
      "x_nadsec_last_seen": "2026-04-07T08:02:01.206Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "63878"
      ],
      "x_nadsec_orgs": [
        "PT Victory Network Indonesia"
      ]
    },
    {
      "created": "2026-04-07T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=45184; asn_org=Den Digital Entertainment Pvt. Ltd. AS ISP india",
      "id": "indicator--228b7fb5-9f6e-461a-b30d-0f8cd6a76b64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.61.113.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T08:05:10.000Z",
      "valid_until": "2026-05-09T08:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-07T08:01:53.131Z",
      "x_nadsec_last_seen": "2026-04-07T08:08:22.986Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45184"
      ],
      "x_nadsec_orgs": [
        "Den Digital Entertainment Pvt. Ltd. AS ISP india"
      ]
    },
    {
      "created": "2026-04-07T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--df7a6a52-9c57-44c9-8899-b975337ae426",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '106.51.148.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T08:05:10.000Z",
      "valid_until": "2026-05-09T08:05:08.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-04-07T07:13:52.712Z",
      "x_nadsec_last_seen": "2026-04-07T07:16:08.598Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-04-07T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--3a3ea046-a7f7-4b0a-8750-25d0553eed73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '106.51.52.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T08:05:10.000Z",
      "valid_until": "2026-05-09T08:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T07:09:19.646Z",
      "x_nadsec_last_seen": "2026-04-07T07:11:25.360Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-04-07T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PK; asn=38264; asn_org=National WiMAXIMS environment; user(top)=**",
      "id": "indicator--3e2d15dc-816e-48fc-ba59-aa68278b612a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '110.37.6.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T08:05:10.000Z",
      "valid_until": "2026-05-09T08:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T07:55:58.869Z",
      "x_nadsec_last_seen": "2026-04-07T07:55:58.869Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "38264"
      ],
      "x_nadsec_orgs": [
        "National WiMAXIMS environment"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-07T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--24c788f4-e64f-4583-aede-f4acbab54304",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.69.35.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T08:05:10.000Z",
      "valid_until": "2026-05-09T08:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-07T07:38:44.412Z",
      "x_nadsec_last_seen": "2026-04-07T07:43:23.036Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-04-07T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--9e9e6bcf-8c2a-4499-8c37-004323218271",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.191.68.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T08:05:10.000Z",
      "valid_until": "2026-05-09T08:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-07T08:03:11.377Z",
      "x_nadsec_last_seen": "2026-04-07T08:10:15.585Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-07T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=56045; asn_org=China Mobile communications corporation",
      "id": "indicator--257ddb82-7ea2-46aa-8fa4-fa42ccf443c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '183.216.51.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T08:05:10.000Z",
      "valid_until": "2026-05-09T08:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T07:13:36.244Z",
      "x_nadsec_last_seen": "2026-04-07T07:15:41.362Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56045"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-04-07T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UZ; asn=39032; asn_org=ist Telekom Jv LLC",
      "id": "indicator--18583404-6cf6-4a30-a7b7-340968354727",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '217.30.174.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T08:05:10.000Z",
      "valid_until": "2026-05-09T08:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T07:54:59.619Z",
      "x_nadsec_last_seen": "2026-04-07T07:57:05.583Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UZ"
      ],
      "x_nadsec_asns": [
        "39032"
      ],
      "x_nadsec_orgs": [
        "ist Telekom Jv LLC"
      ]
    },
    {
      "created": "2026-04-07T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--fb4f92f3-0c2f-45b5-8235-3a81fff0631b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.230.221.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T08:05:10.000Z",
      "valid_until": "2026-05-09T08:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T08:04:30.602Z",
      "x_nadsec_last_seen": "2026-04-07T08:04:30.602Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-07T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--1d8fc362-08a9-4969-b967-8fb71a30a12f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T08:05:10.000Z",
      "valid_until": "2026-05-09T08:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T07:55:13.755Z",
      "x_nadsec_last_seen": "2026-04-07T07:55:13.755Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-07T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--28dbb92c-00b2-495e-817c-14d3eaa5bbeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '78.29.126.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T08:05:10.000Z",
      "valid_until": "2026-05-09T08:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-07T07:08:23.442Z",
      "x_nadsec_last_seen": "2026-04-07T07:26:48.770Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-07T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--0ecd7514-e6d1-42f1-a7db-f7da45ec0b45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '124.217.17.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T09:05:10.000Z",
      "valid_until": "2026-05-09T09:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-07T08:10:42.324Z",
      "x_nadsec_last_seen": "2026-04-07T08:17:16.205Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-04-07T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--34344c3b-1cb6-432e-b47b-3500cadb7322",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '183.82.114.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T09:05:10.000Z",
      "valid_until": "2026-05-09T09:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-07T08:48:01.638Z",
      "x_nadsec_last_seen": "2026-04-07T08:48:39.223Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-04-07T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--7bb2270d-b2d2-4362-ac4d-de9775a98584",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.169.107.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T09:05:10.000Z",
      "valid_until": "2026-05-09T09:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T08:55:10.359Z",
      "x_nadsec_last_seen": "2026-04-07T08:55:10.359Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-07T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MY; asn=4788; asn_org=TM TECHNOLOGY SERVICES SDN. BHD.",
      "id": "indicator--17cff500-b319-4a54-aa05-81d92cf680e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '210.187.50.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T09:05:10.000Z",
      "valid_until": "2026-05-09T09:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-07T08:38:40.957Z",
      "x_nadsec_last_seen": "2026-04-20T19:49:42.791Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "4788"
      ],
      "x_nadsec_orgs": [
        "TM TECHNOLOGY SERVICES SDN. BHD."
      ]
    },
    {
      "created": "2026-04-07T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8492; asn_org=OBIT Ltd.",
      "id": "indicator--37a9df55-5e14-4c16-8a6e-f538dd931289",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.134.194.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T09:05:10.000Z",
      "valid_until": "2026-05-09T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T08:42:01.242Z",
      "x_nadsec_last_seen": "2026-04-07T08:44:07.635Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8492"
      ],
      "x_nadsec_orgs": [
        "OBIT Ltd."
      ]
    },
    {
      "created": "2026-04-07T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--0c7990ee-1ec1-486f-92a8-5cd6edbbe72a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '89.223.108.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T09:05:10.000Z",
      "valid_until": "2026-05-09T09:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-07T08:21:04.565Z",
      "x_nadsec_last_seen": "2026-04-07T08:25:13.589Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-07T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--832e0197-ffb0-499b-9672-d31f01d28d5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '125.160.132.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T10:05:10.000Z",
      "valid_until": "2026-05-09T10:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T09:43:52.976Z",
      "x_nadsec_last_seen": "2026-04-07T09:45:58.336Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-07T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--fd9d5559-f9fc-4129-97b3-3ce9b71854bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.11.153.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T10:05:10.000Z",
      "valid_until": "2026-05-09T10:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T09:23:32.443Z",
      "x_nadsec_last_seen": "2026-04-07T09:25:36.779Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-04-07T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TH; asn=38794; asn_org=UIH",
      "id": "indicator--30b93899-f06b-4ff4-a53d-453a797b64fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '203.114.71.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T10:05:10.000Z",
      "valid_until": "2026-05-09T10:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T10:04:41.940Z",
      "x_nadsec_last_seen": "2026-04-07T10:08:08.569Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "38794"
      ],
      "x_nadsec_orgs": [
        "UIH"
      ]
    },
    {
      "created": "2026-04-07T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--c9505ccd-2729-468c-b079-3e997ed5a662",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T10:05:10.000Z",
      "valid_until": "2026-05-09T10:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-07T10:01:03.728Z",
      "x_nadsec_last_seen": "2026-04-13T03:33:13.588Z",
      "x_nadsec_ports": [
        "445",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-07T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--be80cae7-6ae8-4fb7-b2a0-809f203f4b97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T10:05:10.000Z",
      "valid_until": "2026-05-09T10:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T09:23:54.487Z",
      "x_nadsec_last_seen": "2026-04-23T05:49:08.185Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-04-07T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PL; asn=5617; asn_org=Orange Polska Spolka Akcyjna",
      "id": "indicator--1a4ede26-6870-4437-b637-daafdb82557e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.186.192.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T10:05:10.000Z",
      "valid_until": "2026-05-09T10:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T09:27:55.135Z",
      "x_nadsec_last_seen": "2026-04-07T09:27:55.135Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "5617"
      ],
      "x_nadsec_orgs": [
        "Orange Polska Spolka Akcyjna"
      ]
    },
    {
      "created": "2026-04-07T11:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--5377fc45-f076-4cfd-9f90-cac5a01abed8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T11:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '171.7.104.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T11:05:09.000Z",
      "valid_until": "2026-05-09T11:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T10:56:41.119Z",
      "x_nadsec_last_seen": "2026-04-07T10:58:45.672Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-04-07T11:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=UY; asn=6057; asn_org=Administracion Nacional de Telecomunicaciones; user(top)=**",
      "id": "indicator--e3c2defb-2fce-438b-8e33-4d43ba6ca84f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T11:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '179.26.168.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T11:05:09.000Z",
      "valid_until": "2026-05-09T11:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T10:45:47.653Z",
      "x_nadsec_last_seen": "2026-04-07T10:45:47.653Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "UY"
      ],
      "x_nadsec_asns": [
        "6057"
      ],
      "x_nadsec_orgs": [
        "Administracion Nacional de Telecomunicaciones"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-07T11:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--28f6bf11-b031-4190-9a2b-551cd8d4f11e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T11:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.83.150.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T11:05:09.000Z",
      "valid_until": "2026-05-09T11:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T10:57:00.143Z",
      "x_nadsec_last_seen": "2026-04-07T10:57:10.547Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-07T11:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--b4f1c366-3744-4c93-8373-5e1a6d45ae19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T11:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.21.53.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T11:05:09.000Z",
      "valid_until": "2026-05-09T11:05:08.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-04-07T10:50:39.821Z",
      "x_nadsec_last_seen": "2026-04-07T13:29:15.799Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1***5"
      ]
    },
    {
      "created": "2026-04-07T11:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--74881bf5-2472-4c71-acb6-d54eb955ee03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T11:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.135.253.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T11:05:09.000Z",
      "valid_until": "2026-05-09T11:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-07T10:11:12.339Z",
      "x_nadsec_last_seen": "2026-04-07T10:18:53.545Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-07T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=133982; asn_org=Excitel Broadband Private Limited",
      "id": "indicator--90215471-9dfa-47aa-9830-890085aabe4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '110.235.234.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T12:05:10.000Z",
      "valid_until": "2026-05-09T12:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-07T11:08:11.097Z",
      "x_nadsec_last_seen": "2026-04-07T11:12:59.293Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133982"
      ],
      "x_nadsec_orgs": [
        "Excitel Broadband Private Limited"
      ]
    },
    {
      "created": "2026-04-07T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia; user(top)=**",
      "id": "indicator--95922197-b292-4928-aed2-9c2e3b495108",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.88.16.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T12:05:10.000Z",
      "valid_until": "2026-05-09T12:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T11:50:20.599Z",
      "x_nadsec_last_seen": "2026-04-12T20:11:21.257Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-07T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--92e7b3ed-653c-4217-88ce-477c29a7caf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T12:05:10.000Z",
      "valid_until": "2026-05-09T12:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-07T11:22:53.819Z",
      "x_nadsec_last_seen": "2026-04-17T09:34:55.567Z",
      "x_nadsec_ports": [
        "135",
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-07T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45557; asn_org=Vietnam Technology and Telecommunication JSC",
      "id": "indicator--f9b49ca2-0486-4d62-ae97-1575b41e65b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.153.221.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T13:05:11.000Z",
      "valid_until": "2026-05-09T13:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-07T12:39:37.639Z",
      "x_nadsec_last_seen": "2026-04-07T12:47:02.364Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45557"
      ],
      "x_nadsec_orgs": [
        "Vietnam Technology and Telecommunication JSC"
      ]
    },
    {
      "created": "2026-04-07T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MA; asn=6713; asn_org=Itissalat Al-MAGHRIB",
      "id": "indicator--099e1c1c-df05-4a9e-8a59-99cdae66e6cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.146.242.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T13:05:11.000Z",
      "valid_until": "2026-05-09T13:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-07T12:15:02.634Z",
      "x_nadsec_last_seen": "2026-04-07T12:15:48.395Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "6713"
      ],
      "x_nadsec_orgs": [
        "Itissalat Al-MAGHRIB"
      ]
    },
    {
      "created": "2026-04-07T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e75a56fb-7724-41e4-924f-8f5c369ba11e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '167.71.244.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T13:05:11.000Z",
      "valid_until": "2026-05-09T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T12:58:49.592Z",
      "x_nadsec_last_seen": "2026-04-07T12:58:49.592Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-07T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--3f3994f0-53f4-437b-b547-3beef4c8a82d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '183.82.103.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T13:05:11.000Z",
      "valid_until": "2026-05-09T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T12:18:38.551Z",
      "x_nadsec_last_seen": "2026-04-07T12:23:06.995Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-04-07T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--0523467f-1049-4749-b522-218d32a1a299",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T13:05:11.000Z",
      "valid_until": "2026-05-09T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T13:00:20.933Z",
      "x_nadsec_last_seen": "2026-04-25T15:09:14.440Z",
      "x_nadsec_ports": [
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-07T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--3285a80a-240e-459c-9c23-4acfd5107aa3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.184.34.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T13:05:11.000Z",
      "valid_until": "2026-05-09T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T12:12:44.046Z",
      "x_nadsec_last_seen": "2026-04-07T12:12:44.174Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-07T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--e2279554-6d61-4a3a-a615-90ead5d02040",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T13:05:11.000Z",
      "valid_until": "2026-05-09T13:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-07T12:33:03.755Z",
      "x_nadsec_last_seen": "2026-04-18T02:39:20.492Z",
      "x_nadsec_ports": [
        "445",
        "1883"
      ],
      "x_nadsec_services": [
        "smbd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-07T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--d14e47c2-9203-4b88-99b9-210cfe5ae7a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T13:05:11.000Z",
      "valid_until": "2026-05-09T13:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-07T12:53:50.739Z",
      "x_nadsec_last_seen": "2026-04-15T17:59:42.378Z",
      "x_nadsec_ports": [
        "135",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-07T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f8639441-5581-4f90-9b1a-46ddfbb9b136",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '67.205.161.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T13:05:11.000Z",
      "valid_until": "2026-05-09T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T12:51:22.026Z",
      "x_nadsec_last_seen": "2026-04-07T12:51:25.232Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-07T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--ec7a58f9-7eb0-4118-8b33-f3d1107ca820",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T13:05:11.000Z",
      "valid_until": "2026-05-09T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T12:52:53.489Z",
      "x_nadsec_last_seen": "2026-04-07T12:52:53.489Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-04-07T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--7c11eebf-21a2-433d-8ebe-6c3cae7927e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '106.219.71.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T14:05:10.000Z",
      "valid_until": "2026-05-09T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T13:05:09.943Z",
      "x_nadsec_last_seen": "2026-04-07T13:07:14.798Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-04-07T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--b33add81-207a-46f6-92f7-21a9b4676226",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.162.84.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T14:05:10.000Z",
      "valid_until": "2026-05-09T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T13:06:00.409Z",
      "x_nadsec_last_seen": "2026-04-07T13:09:22.857Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-07T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--79bdc375-c50b-4772-be0a-96ea975b921c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.237.127.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T14:05:10.000Z",
      "valid_until": "2026-05-09T14:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T13:49:49.020Z",
      "x_nadsec_last_seen": "2026-04-07T13:49:59.435Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-07T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=11664; asn_org=Techtel LMDS Comunicaciones Interactivas S.A.",
      "id": "indicator--5cb7390c-0289-4f71-8ffa-6a4352e9a519",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.123.212.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T14:05:10.000Z",
      "valid_until": "2026-05-09T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T13:37:06.007Z",
      "x_nadsec_last_seen": "2026-04-07T13:39:13.167Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "11664"
      ],
      "x_nadsec_orgs": [
        "Techtel LMDS Comunicaciones Interactivas S.A."
      ]
    },
    {
      "created": "2026-04-07T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--7fbad40b-b00a-4f20-aff5-b05154dce8f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.80.206.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T14:05:10.000Z",
      "valid_until": "2026-05-09T14:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T13:21:23.726Z",
      "x_nadsec_last_seen": "2026-04-07T13:21:33.886Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-07T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--3fd075a7-9ac8-4fc7-8a85-be1d33e855f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T14:05:10.000Z",
      "valid_until": "2026-05-09T14:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-07T13:59:07.337Z",
      "x_nadsec_last_seen": "2026-04-20T13:57:03.678Z",
      "x_nadsec_ports": [
        "135",
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-07T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--80633887-0ef6-46c7-acbd-b3337b80a45e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T14:05:10.000Z",
      "valid_until": "2026-05-09T14:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-07T13:09:02.367Z",
      "x_nadsec_last_seen": "2026-04-30T14:08:41.897Z",
      "x_nadsec_ports": [
        "21",
        "1723",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-07T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=KZ; asn=48503; asn_org=Mobile Telecom-Service LLP",
      "id": "indicator--d1f65ef0-7308-41b1-8140-68eeba7d9f1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.193.106.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T14:05:10.000Z",
      "valid_until": "2026-05-09T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T13:31:46.467Z",
      "x_nadsec_last_seen": "2026-04-07T14:13:52.757Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "48503"
      ],
      "x_nadsec_orgs": [
        "Mobile Telecom-Service LLP"
      ]
    },
    {
      "created": "2026-04-07T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--2819bfde-faf7-4e1d-bff4-28b4d10455c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T14:05:10.000Z",
      "valid_until": "2026-05-09T14:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-07T13:35:36.008Z",
      "x_nadsec_last_seen": "2026-04-12T23:24:21.556Z",
      "x_nadsec_ports": [
        "42",
        "135",
        "35633"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-07T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3c2b1815-ae35-4481-a156-44354210ea0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T14:05:10.000Z",
      "valid_until": "2026-05-09T14:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T13:35:35.498Z",
      "x_nadsec_last_seen": "2026-04-07T13:35:35.498Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-07T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--57c50e01-0711-48a0-9236-921ac9cf673c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T14:05:10.000Z",
      "valid_until": "2026-05-09T14:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T13:55:22.849Z",
      "x_nadsec_last_seen": "2026-04-07T13:55:22.849Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-07T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MY; asn=9534; asn_org=Binariang Berhad",
      "id": "indicator--eb22821b-3c61-4380-ac88-60144b32fed6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '121.121.61.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T15:05:13.000Z",
      "valid_until": "2026-05-09T15:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-07T14:42:40.631Z",
      "x_nadsec_last_seen": "2026-04-07T14:49:24.255Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "9534"
      ],
      "x_nadsec_orgs": [
        "Binariang Berhad"
      ]
    },
    {
      "created": "2026-04-07T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=VE; asn=11562; asn_org=Net Uno, C.A.",
      "id": "indicator--ff02caf9-ac00-468c-881f-ed3227f118f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.153.6.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T15:05:13.000Z",
      "valid_until": "2026-05-09T15:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-07T14:36:36.295Z",
      "x_nadsec_last_seen": "2026-04-07T14:55:42.081Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "11562"
      ],
      "x_nadsec_orgs": [
        "Net Uno, C.A."
      ]
    },
    {
      "created": "2026-04-07T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--ffc4d498-4260-4ff5-a2fd-ca8714813967",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.170.189.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T15:05:13.000Z",
      "valid_until": "2026-05-09T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T14:47:00.782Z",
      "x_nadsec_last_seen": "2026-04-07T14:47:01.502Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-07T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--80b39899-cd06-47de-a783-ccf66509ee11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.80.88.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T15:05:13.000Z",
      "valid_until": "2026-05-09T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T14:55:13.248Z",
      "x_nadsec_last_seen": "2026-04-07T14:55:13.248Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-07T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--3b10489e-34bb-48bb-877a-2c43a97c3e6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T15:05:13.000Z",
      "valid_until": "2026-05-09T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T15:02:47.520Z",
      "x_nadsec_last_seen": "2026-04-26T18:21:54.983Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-07T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ES; asn=200845; asn_org=Avatel Telecom, SA",
      "id": "indicator--220f2897-c1b4-4e7e-9105-6d65cd883dee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '212.104.161.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T15:05:13.000Z",
      "valid_until": "2026-05-09T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T14:17:12.886Z",
      "x_nadsec_last_seen": "2026-04-07T14:19:18.978Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "200845"
      ],
      "x_nadsec_orgs": [
        "Avatel Telecom, SA"
      ]
    },
    {
      "created": "2026-04-07T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--0697e1b9-ce52-4ae6-b703-a9dcfa7e5f75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T15:05:13.000Z",
      "valid_until": "2026-05-09T15:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-07T14:24:51.626Z",
      "x_nadsec_last_seen": "2026-04-18T14:50:15.663Z",
      "x_nadsec_ports": [
        "445",
        "81",
        "135",
        "1723"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper",
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-07T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=34187; asn_org=LLC Renome-Service",
      "id": "indicator--f11e5fce-0e4e-4d86-b37a-4176417ad6ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '78.26.204.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T15:05:13.000Z",
      "valid_until": "2026-05-09T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T14:20:39.537Z",
      "x_nadsec_last_seen": "2026-04-07T14:22:45.579Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "34187"
      ],
      "x_nadsec_orgs": [
        "LLC Renome-Service"
      ]
    },
    {
      "created": "2026-04-07T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=30848; asn_org=UNIDATA S.p.A.",
      "id": "indicator--8f101f7e-442c-450c-96ad-8d41309d0bde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '83.217.182.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T15:05:13.000Z",
      "valid_until": "2026-05-09T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T14:39:26.850Z",
      "x_nadsec_last_seen": "2026-04-07T14:41:33.981Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "30848"
      ],
      "x_nadsec_orgs": [
        "UNIDATA S.p.A."
      ]
    },
    {
      "created": "2026-04-07T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--e5b64017-e0d2-4f8b-be6b-43d6220abf55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '88.248.135.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T15:05:13.000Z",
      "valid_until": "2026-05-09T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T14:30:18.666Z",
      "x_nadsec_last_seen": "2026-04-07T14:30:18.666Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-07T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--76d16c67-87d9-4520-8041-4680150cf303",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '112.27.178.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T16:05:10.000Z",
      "valid_until": "2026-05-09T16:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-07T15:14:40.823Z",
      "x_nadsec_last_seen": "2026-04-22T19:45:54.854Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-04-07T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a930d525-ba1a-485a-bd44-b4bb41ff3991",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.202.117.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T16:05:10.000Z",
      "valid_until": "2026-05-09T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T15:24:08.040Z",
      "x_nadsec_last_seen": "2026-04-07T15:24:08.040Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-07T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CL; asn=14259; asn_org=Gtd Internet S.A.",
      "id": "indicator--b19e72d6-9a70-4dca-8ed9-58c4ee361fa3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '181.190.6.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T16:05:10.000Z",
      "valid_until": "2026-05-09T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T15:10:24.355Z",
      "x_nadsec_last_seen": "2026-04-07T15:12:31.533Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "14259"
      ],
      "x_nadsec_orgs": [
        "Gtd Internet S.A."
      ]
    },
    {
      "created": "2026-04-07T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--a653049e-e23e-4668-bb4c-861691a6e4b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T16:05:10.000Z",
      "valid_until": "2026-05-09T16:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-07T15:59:56.964Z",
      "x_nadsec_last_seen": "2026-04-22T19:44:04.930Z",
      "x_nadsec_ports": [
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-04-07T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2362; services=smbd; ports=445; cc=RU; asn=42610; asn_org=Rostelecom",
      "id": "indicator--3481f82f-0002-4499-acf9-e7654e0991d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '188.255.116.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T16:05:10.000Z",
      "valid_until": "2026-05-09T16:05:09.000Z",
      "x_nadsec_event_count": 3105,
      "x_nadsec_first_seen": "2026-04-07T15:13:19.882Z",
      "x_nadsec_last_seen": "2026-04-07T16:18:43.727Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "42610"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-07T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=28191; asn_org=Jupiter Telecomunicacoes e Informatica Ltda; user(top)=**",
      "id": "indicator--5bb0d155-1e8a-4bcb-9746-0bca0438dd5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.90.33.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T16:05:10.000Z",
      "valid_until": "2026-05-09T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T15:06:02.816Z",
      "x_nadsec_last_seen": "2026-04-10T21:04:22.532Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28191"
      ],
      "x_nadsec_orgs": [
        "Jupiter Telecomunicacoes e Informatica Ltda"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-07T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--47289d23-f5fd-4328-b6ba-a1baa23ebe02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T16:05:10.000Z",
      "valid_until": "2026-05-09T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T15:56:01.550Z",
      "x_nadsec_last_seen": "2026-04-09T21:43:21.280Z",
      "x_nadsec_ports": [
        "1433",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-07T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--e9297c02-a45b-4c2a-9ba6-642c98b2619d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T16:05:10.000Z",
      "valid_until": "2026-05-09T16:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-07T15:10:19.970Z",
      "x_nadsec_last_seen": "2026-04-22T12:35:39.940Z",
      "x_nadsec_ports": [
        "135",
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-07T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8486a3e4-01f5-4ed5-9d4c-eb9911aa4c9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T16:05:10.000Z",
      "valid_until": "2026-05-09T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T15:34:07.818Z",
      "x_nadsec_last_seen": "2026-04-07T15:34:07.818Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-07T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=KZ; asn=39824; asn_org=JSC Alma Telecommunications",
      "id": "indicator--fd087a49-401a-47ff-940a-8de8bd2c52f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.134.37.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T16:05:10.000Z",
      "valid_until": "2026-05-09T16:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-07T15:16:19.683Z",
      "x_nadsec_last_seen": "2026-04-07T15:23:29.347Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "39824"
      ],
      "x_nadsec_orgs": [
        "JSC Alma Telecommunications"
      ]
    },
    {
      "created": "2026-04-07T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--0c570b6b-35e8-46b7-aeed-5cb6338f5778",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '81.10.3.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T16:05:10.000Z",
      "valid_until": "2026-05-09T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T15:06:06.157Z",
      "x_nadsec_last_seen": "2026-04-15T07:21:51.007Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-07T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--0ee4c896-6167-4e9d-8217-71f068b38751",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '112.74.38.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T17:05:10.000Z",
      "valid_until": "2026-05-09T17:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T16:43:18.038Z",
      "x_nadsec_last_seen": "2026-04-07T16:43:18.038Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ]
    },
    {
      "created": "2026-04-07T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--71133ec2-5cbe-4c12-930e-05efcccfe0c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T17:05:10.000Z",
      "valid_until": "2026-05-09T17:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T16:32:45.071Z",
      "x_nadsec_last_seen": "2026-04-07T16:32:45.071Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-07T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=BR; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--46fb3d34-342b-40d0-aceb-c87e5ce325b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.197.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T18:05:10.000Z",
      "valid_until": "2026-05-09T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T18:03:11.366Z",
      "x_nadsec_last_seen": "2026-04-07T18:03:41.081Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-07T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ec0ee394-b2d7-4d33-a4dc-6f6eda17536f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.163.14.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T18:05:10.000Z",
      "valid_until": "2026-05-09T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T17:08:31.726Z",
      "x_nadsec_last_seen": "2026-04-07T17:08:31.726Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-07T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--a66a1daf-8c91-4512-a98a-cbd356ceba69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T18:05:10.000Z",
      "valid_until": "2026-05-09T18:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-07T17:44:01.290Z",
      "x_nadsec_last_seen": "2026-04-07T17:44:41.549Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-04-07T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--666da0bb-cc7d-4041-b994-70b321ccb1cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T18:05:10.000Z",
      "valid_until": "2026-05-09T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T17:38:05.435Z",
      "x_nadsec_last_seen": "2026-04-07T17:38:05.435Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-07T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=11426; asn_org=Charter Communications Inc",
      "id": "indicator--5fa29840-df92-4fff-83fa-af197bd68ba8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.57.151.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T18:05:10.000Z",
      "valid_until": "2026-05-09T18:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-07T17:41:29.826Z",
      "x_nadsec_last_seen": "2026-04-07T17:48:03.521Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "11426"
      ],
      "x_nadsec_orgs": [
        "Charter Communications Inc"
      ]
    },
    {
      "created": "2026-04-07T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=KR; asn=4766; asn_org=Korea Telecom",
      "id": "indicator--46588858-8f40-46d6-b657-44b6d7e901e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '112.163.117.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T19:05:11.000Z",
      "valid_until": "2026-05-09T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T18:11:01.523Z",
      "x_nadsec_last_seen": "2026-04-07T18:11:01.523Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "4766"
      ],
      "x_nadsec_orgs": [
        "Korea Telecom"
      ]
    },
    {
      "created": "2026-04-07T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--725103a3-8c88-461a-a2b2-d81f8e15f6f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.241.104.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T19:05:11.000Z",
      "valid_until": "2026-05-09T19:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-07T19:01:12.606Z",
      "x_nadsec_last_seen": "2026-04-07T19:07:39.809Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-07T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--9b6f6943-9bb4-46c0-ae66-20b8b2dafc7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.206.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T19:05:11.000Z",
      "valid_until": "2026-05-09T19:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-07T18:48:53.832Z",
      "x_nadsec_last_seen": "2026-04-22T18:59:13.848Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-07T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=DE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--2dfb9f7c-f001-4838-af03-91cb59ae2b9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.164.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T19:05:11.000Z",
      "valid_until": "2026-05-09T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-07T18:13:12.920Z",
      "x_nadsec_last_seen": "2026-04-07T18:13:37.045Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-07T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PE; asn=262210; asn_org=VIETTEL PERU S.A.C.",
      "id": "indicator--5876fcc7-7648-4fd6-9918-caa97a3916fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '181.176.136.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T19:05:11.000Z",
      "valid_until": "2026-05-09T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-07T18:06:44.312Z",
      "x_nadsec_last_seen": "2026-04-07T18:06:49.130Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "262210"
      ],
      "x_nadsec_orgs": [
        "VIETTEL PERU S.A.C."
      ]
    },
    {
      "created": "2026-04-07T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--7d064174-205f-4395-8794-434b3105dbff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T19:05:11.000Z",
      "valid_until": "2026-05-09T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T18:57:33.669Z",
      "x_nadsec_last_seen": "2026-04-07T18:57:33.669Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-07T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--614d9d8c-686f-41d5-b789-c0a9d8329b2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T19:05:11.000Z",
      "valid_until": "2026-05-09T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T18:57:33.418Z",
      "x_nadsec_last_seen": "2026-04-07T18:57:33.418Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-07T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--315ed9c5-aba3-4163-ae64-fad84520a880",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.189.197.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T19:05:11.000Z",
      "valid_until": "2026-05-09T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T18:10:45.078Z",
      "x_nadsec_last_seen": "2026-04-07T18:12:52.136Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-04-07T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4a5cb570-e033-499d-a2bd-0a1bbecdea46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '13.89.124.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T20:05:10.000Z",
      "valid_until": "2026-05-09T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T19:15:28.964Z",
      "x_nadsec_last_seen": "2026-04-07T19:15:29.660Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-07T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--b5aa8776-8442-4677-9474-04854d21d322",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.241.104.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T20:05:10.000Z",
      "valid_until": "2026-05-09T20:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-07T19:28:35.104Z",
      "x_nadsec_last_seen": "2026-04-07T19:37:35.304Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-04-07T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=27699; asn_org=TELEFONICA BRASIL S.A; user(top)=**",
      "id": "indicator--6e94d7e7-05f5-4e64-b008-9efde01f0997",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '201.27.236.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T20:05:10.000Z",
      "valid_until": "2026-05-09T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T19:25:42.882Z",
      "x_nadsec_last_seen": "2026-04-14T15:34:20.029Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "27699"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-07T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=20; services=mysqld; ports=3306; cc=MM; asn=136474; asn_org=Marga Global Telecom Limited",
      "id": "indicator--3ee5ff9d-dd40-453d-8073-f21d5fac2aa5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '42.156.32.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T20:05:10.000Z",
      "valid_until": "2026-05-09T20:05:09.000Z",
      "x_nadsec_event_count": 20,
      "x_nadsec_first_seen": "2026-04-07T19:39:02.297Z",
      "x_nadsec_last_seen": "2026-04-07T19:39:02.399Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "MM"
      ],
      "x_nadsec_asns": [
        "136474"
      ],
      "x_nadsec_orgs": [
        "Marga Global Telecom Limited"
      ]
    },
    {
      "created": "2026-04-07T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=GB; asn=51561; asn_org=ICUK Computing Services Limited; user(top)=**",
      "id": "indicator--41c55615-8357-4b5a-9611-5f7eaffc0bec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.133.168.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T20:05:10.000Z",
      "valid_until": "2026-05-09T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T19:40:20.813Z",
      "x_nadsec_last_seen": "2026-04-15T12:24:42.537Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "51561"
      ],
      "x_nadsec_orgs": [
        "ICUK Computing Services Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-07T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--52c358d5-0649-461c-a734-893a9939e7a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.15.179.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T20:05:10.000Z",
      "valid_until": "2026-05-09T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T19:43:48.021Z",
      "x_nadsec_last_seen": "2026-04-07T19:43:48.067Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-07T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--2feb3654-5bab-4b4d-bdf8-04c627df8cb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T20:05:10.000Z",
      "valid_until": "2026-05-09T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T19:47:26.771Z",
      "x_nadsec_last_seen": "2026-04-14T06:20:15.768Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-07T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--83d699d7-915f-4060-903e-27ae2c7f066e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T20:05:10.000Z",
      "valid_until": "2026-05-09T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T19:46:47.444Z",
      "x_nadsec_last_seen": "2026-04-07T19:46:47.812Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-07T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--962701da-bbfa-431c-a6c6-3733b227e140",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T20:05:10.000Z",
      "valid_until": "2026-05-09T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T19:47:16.465Z",
      "x_nadsec_last_seen": "2026-04-10T09:10:01.306Z",
      "x_nadsec_ports": [
        "1433",
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-07T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8359; asn_org=MTS PJSC",
      "id": "indicator--764f2076-50e8-4afb-806b-3950a22087bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '95.139.44.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T20:05:10.000Z",
      "valid_until": "2026-05-09T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T19:37:17.421Z",
      "x_nadsec_last_seen": "2026-04-07T19:39:24.366Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8359"
      ],
      "x_nadsec_orgs": [
        "MTS PJSC"
      ]
    },
    {
      "created": "2026-04-07T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=134756; asn_org=CHINANET Nanjing Jishan IDC network; user(top)=**",
      "id": "indicator--21a1f1aa-8f1a-4186-b5d8-64754807c750",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '180.110.204.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T21:05:10.000Z",
      "valid_until": "2026-05-09T21:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T20:15:08.883Z",
      "x_nadsec_last_seen": "2026-04-07T20:15:08.883Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "134756"
      ],
      "x_nadsec_orgs": [
        "CHINANET Nanjing Jishan IDC network"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-07T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=13489; asn_org=UNE EPM TELECOMUNICACIONES S.A.",
      "id": "indicator--6a437c58-b229-4cfa-8bdb-649f1d9550d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '181.129.143.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T21:05:10.000Z",
      "valid_until": "2026-05-09T21:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T20:24:35.727Z",
      "x_nadsec_last_seen": "2026-04-07T20:26:42.524Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "13489"
      ],
      "x_nadsec_orgs": [
        "UNE EPM TELECOMUNICACIONES S.A."
      ]
    },
    {
      "created": "2026-04-07T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--2930bde0-e7d9-48cb-b037-51ec14e7ec88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T21:05:10.000Z",
      "valid_until": "2026-05-09T21:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T20:52:22.286Z",
      "x_nadsec_last_seen": "2026-04-07T20:52:22.286Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-07T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--7940b703-222b-4d55-ad81-96acbdb0e0c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T21:05:10.000Z",
      "valid_until": "2026-05-09T21:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T20:52:22.022Z",
      "x_nadsec_last_seen": "2026-04-07T20:52:46.360Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-07T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--bd9ec3ed-b696-4249-b5fd-e7f4a9034874",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T21:05:10.000Z",
      "valid_until": "2026-05-09T21:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T20:52:56.633Z",
      "x_nadsec_last_seen": "2026-04-07T20:52:56.633Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-07T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a499dae7-987e-4a69-9b13-7d1add57633d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T21:05:10.000Z",
      "valid_until": "2026-05-09T21:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-07T20:23:37.447Z",
      "x_nadsec_last_seen": "2026-04-10T02:43:57.703Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-07T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=396982; asn_org=Google LLC; user(top)=**",
      "id": "indicator--ea92a6cf-c511-4645-bcd2-09bbc69784a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.93.191.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T21:05:10.000Z",
      "valid_until": "2026-05-09T21:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T20:54:55.941Z",
      "x_nadsec_last_seen": "2026-04-13T06:00:59.382Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-07T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--dc01f7ac-fb03-4d1b-a8e2-27371d09004d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.233.21.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T21:05:10.000Z",
      "valid_until": "2026-05-09T21:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-07T20:21:19.744Z",
      "x_nadsec_last_seen": "2026-04-25T22:00:10.136Z",
      "x_nadsec_ports": [
        "21",
        "27017",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-04-07T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=31200; asn_org=Novotelecom Ltd",
      "id": "indicator--379ec286-cdd8-4064-9779-e6b64e30a848",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.128.121.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T21:05:10.000Z",
      "valid_until": "2026-05-09T21:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T20:35:48.231Z",
      "x_nadsec_last_seen": "2026-04-07T20:35:48.247Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31200"
      ],
      "x_nadsec_orgs": [
        "Novotelecom Ltd"
      ]
    },
    {
      "created": "2026-04-07T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--7d58cc5c-9793-4181-96af-69ccfbd8bf0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T21:05:10.000Z",
      "valid_until": "2026-05-09T21:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T20:32:06.173Z",
      "x_nadsec_last_seen": "2026-04-14T11:38:59.417Z",
      "x_nadsec_ports": [
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-07T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--3fadb1eb-937e-48d6-9004-0e3a5d73f073",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T21:05:10.000Z",
      "valid_until": "2026-05-09T21:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T20:19:25.754Z",
      "x_nadsec_last_seen": "2026-04-11T12:33:09.733Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-07T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=HK; asn=132883; asn_org=TOPWAY GLOBAL LIMITED; user(top)=**; pass(top)=1****6",
      "id": "indicator--2d38ddbb-02c5-4285-a139-1fc91253bd03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.87.9.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T22:05:10.000Z",
      "valid_until": "2026-05-09T22:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-04-07T21:20:14.534Z",
      "x_nadsec_last_seen": "2026-04-17T18:56:15.042Z",
      "x_nadsec_ports": [
        "27017",
        "1433"
      ],
      "x_nadsec_services": [
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "132883"
      ],
      "x_nadsec_orgs": [
        "TOPWAY GLOBAL LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6"
      ]
    },
    {
      "created": "2026-04-07T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--c5e27439-4d11-471a-a1bb-d82fe2f44054",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '120.210.47.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T22:05:10.000Z",
      "valid_until": "2026-05-09T22:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-07T21:27:24.571Z",
      "x_nadsec_last_seen": "2026-04-22T23:00:27.448Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-04-07T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MX; asn=8151; asn_org=UNINET; user(top)=**",
      "id": "indicator--4cb3642e-c275-4e22-a9ea-329ee2900f30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '187.212.166.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T22:05:10.000Z",
      "valid_until": "2026-05-09T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T21:59:42.393Z",
      "x_nadsec_last_seen": "2026-04-07T21:59:42.393Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-07T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--f7637ddf-d1a1-4081-9d15-d976d62659c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T22:05:10.000Z",
      "valid_until": "2026-05-09T22:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-07T21:29:00.672Z",
      "x_nadsec_last_seen": "2026-04-28T17:21:00.511Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-07T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=TH; asn=4618; asn_org=Internet Thailand Company Limited; user(top)=**",
      "id": "indicator--8ea34d3c-c7f9-445b-8c6e-c52d93b3429f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '203.154.89.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T22:05:10.000Z",
      "valid_until": "2026-05-09T22:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-07T21:58:50.168Z",
      "x_nadsec_last_seen": "2026-04-27T10:32:36.300Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "4618"
      ],
      "x_nadsec_orgs": [
        "Internet Thailand Company Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-07T23:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=RU; asn=51604; asn_org=JSC ER-Telecom Holding",
      "id": "indicator--ff9a951b-9991-47f5-bcd7-0045733f03b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T23:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '109.195.98.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T23:05:11.000Z",
      "valid_until": "2026-05-09T23:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T22:58:32.355Z",
      "x_nadsec_last_seen": "2026-04-07T22:58:34.055Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "51604"
      ],
      "x_nadsec_orgs": [
        "JSC ER-Telecom Holding"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-07T23:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--b21eddee-40f0-4d20-a6c4-e3799595fbe1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T23:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.96.62.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T23:05:11.000Z",
      "valid_until": "2026-05-09T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T22:51:03.863Z",
      "x_nadsec_last_seen": "2026-04-07T22:53:08.575Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-04-07T23:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=28015; asn_org=MERCO COMUNICACIONES",
      "id": "indicator--02bec273-c43f-4178-8de8-66894786a296",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T23:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '201.219.170.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T23:05:11.000Z",
      "valid_until": "2026-05-09T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T22:37:37.506Z",
      "x_nadsec_last_seen": "2026-04-07T22:39:44.043Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "28015"
      ],
      "x_nadsec_orgs": [
        "MERCO COMUNICACIONES"
      ]
    },
    {
      "created": "2026-04-08T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PK; asn=23674; asn_org=Nayatel Pvt Ltd",
      "id": "indicator--8a8bbfd5-8c1a-44c9-82a9-b798004af279",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '124.109.33.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T00:05:14.000Z",
      "valid_until": "2026-05-10T00:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-07T23:19:37.591Z",
      "x_nadsec_last_seen": "2026-04-07T23:26:22.386Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23674"
      ],
      "x_nadsec_orgs": [
        "Nayatel Pvt Ltd"
      ]
    },
    {
      "created": "2026-04-08T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=201624; asn_org=ARANEA LLC",
      "id": "indicator--c3d6bb35-ee22-4c55-bc2c-0fb668790fa8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.118.199.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T00:05:14.000Z",
      "valid_until": "2026-05-10T00:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-07T23:13:21.921Z",
      "x_nadsec_last_seen": "2026-04-07T23:15:28.440Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "201624"
      ],
      "x_nadsec_orgs": [
        "ARANEA LLC"
      ]
    },
    {
      "created": "2026-04-08T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--53f955ae-3494-4b0f-ab50-0efd62902440",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T00:05:14.000Z",
      "valid_until": "2026-05-10T00:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-07T23:25:18.043Z",
      "x_nadsec_last_seen": "2026-04-07T23:25:18.043Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-08T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=35663; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--d020faf6-0fb4-4f5c-a23d-7edde044b961",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T00:05:14.000Z",
      "valid_until": "2026-05-10T00:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T23:10:22.749Z",
      "x_nadsec_last_seen": "2026-04-07T23:10:22.752Z",
      "x_nadsec_ports": [
        "42",
        "35663"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-08T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--b15360be-d996-45cf-bf2b-637f0c262e4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T00:05:14.000Z",
      "valid_until": "2026-05-10T00:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T23:57:33.767Z",
      "x_nadsec_last_seen": "2026-04-13T08:40:04.294Z",
      "x_nadsec_ports": [
        "445",
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-08T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services; user(top)=**",
      "id": "indicator--fb77f30f-2708-47b5-b7fa-46e17a9f3f42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '122.160.9.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T01:05:10.000Z",
      "valid_until": "2026-05-10T01:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-08T00:58:12.565Z",
      "x_nadsec_last_seen": "2026-04-29T09:01:49.113Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-08T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--d6821c41-e209-4401-91f8-34ed8602aba4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.205.150.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T01:05:10.000Z",
      "valid_until": "2026-05-10T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T00:58:10.768Z",
      "x_nadsec_last_seen": "2026-04-08T00:58:10.768Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-08T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--46540cbe-22ed-4db8-99a2-ae7b3657c84a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T01:05:10.000Z",
      "valid_until": "2026-05-10T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T00:20:22.233Z",
      "x_nadsec_last_seen": "2026-04-08T00:20:22.233Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-08T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--049ddc40-6283-416b-8c86-303caf017342",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.253.116.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T02:05:10.000Z",
      "valid_until": "2026-05-10T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T01:13:28.132Z",
      "x_nadsec_last_seen": "2026-04-08T01:13:28.132Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-08T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=RU; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--5ee5aa00-22d7-431a-a0a6-2a6b3a236fa3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.179.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T02:05:10.000Z",
      "valid_until": "2026-05-10T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T01:21:25.177Z",
      "x_nadsec_last_seen": "2026-04-08T01:21:55.275Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-08T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--08767ca3-6073-4569-a31c-83352f7ab186",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.176.84.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T02:05:10.000Z",
      "valid_until": "2026-05-10T02:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-08T01:41:12.091Z",
      "x_nadsec_last_seen": "2026-04-08T01:49:48.940Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-04-08T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--69a73c4b-4549-497e-9d9a-8ddebcb237b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T02:05:10.000Z",
      "valid_until": "2026-05-10T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-08T01:34:47.537Z",
      "x_nadsec_last_seen": "2026-04-26T19:09:43.935Z",
      "x_nadsec_ports": [
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-08T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--d3416f16-c914-4603-a838-3a008f9a5134",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '218.70.198.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T02:05:10.000Z",
      "valid_until": "2026-05-10T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T01:51:37.265Z",
      "x_nadsec_last_seen": "2026-04-08T01:51:37.265Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-08T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--9de6679a-b550-4050-84ee-550928b91958",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T02:05:10.000Z",
      "valid_until": "2026-05-10T02:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-08T01:38:56.774Z",
      "x_nadsec_last_seen": "2026-04-21T14:31:16.681Z",
      "x_nadsec_ports": [
        "445",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-08T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=15493; asn_org=Russian company LLC",
      "id": "indicator--e0dab5c8-fec7-4932-af6e-f43a9a9d5f23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '77.242.111.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T02:05:10.000Z",
      "valid_until": "2026-05-10T02:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-08T01:15:02.619Z",
      "x_nadsec_last_seen": "2026-04-08T01:16:16.625Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "15493"
      ],
      "x_nadsec_orgs": [
        "Russian company LLC"
      ]
    },
    {
      "created": "2026-04-08T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=ID; asn=142350; asn_org=PT Skala Jaringan Indonesia",
      "id": "indicator--56fd4c2f-0cc8-40d0-bf3e-bbf286b98684",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.168.148.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T03:05:10.000Z",
      "valid_until": "2026-05-10T03:05:08.000Z",
      "x_nadsec_event_count": 3152,
      "x_nadsec_first_seen": "2026-04-08T02:31:17.164Z",
      "x_nadsec_last_seen": "2026-04-08T03:51:07.288Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "142350"
      ],
      "x_nadsec_orgs": [
        "PT Skala Jaringan Indonesia"
      ]
    },
    {
      "created": "2026-04-08T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--bc0ad405-0cf6-4045-800a-0dd9b76d85e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '115.73.35.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T03:05:10.000Z",
      "valid_until": "2026-05-10T03:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T02:29:29.004Z",
      "x_nadsec_last_seen": "2026-04-08T02:31:34.692Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-08T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=55990; asn_org=Huawei Cloud Service data center; user(top)=**; pass(top)=***",
      "id": "indicator--abaaaff7-a6ba-4abd-b963-16ac7fec5460",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '121.37.97.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T03:05:10.000Z",
      "valid_until": "2026-05-10T03:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T02:18:32.548Z",
      "x_nadsec_last_seen": "2026-04-08T02:18:32.548Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "55990"
      ],
      "x_nadsec_orgs": [
        "Huawei Cloud Service data center"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "***"
      ]
    },
    {
      "created": "2026-04-08T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--4f4a2851-f9fc-40eb-a980-3d471a8ff54c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T03:05:10.000Z",
      "valid_until": "2026-05-10T03:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T02:35:59.009Z",
      "x_nadsec_last_seen": "2026-04-19T17:27:40.221Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-08T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--0e82169b-fb6d-4acf-bed6-1cc30502d346",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '180.246.231.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T03:05:10.000Z",
      "valid_until": "2026-05-10T03:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-08T02:33:56.572Z",
      "x_nadsec_last_seen": "2026-04-08T02:33:56.802Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-08T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--fa5423f8-6894-4eba-b4cd-fdf18c39bb47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.219.202.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T03:05:10.000Z",
      "valid_until": "2026-05-10T03:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-08T02:11:37.913Z",
      "x_nadsec_last_seen": "2026-04-09T03:13:18.587Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-08T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b4ad24d1-a469-4a23-aa2f-0e3b3e50c981",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.102.92.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T03:05:10.000Z",
      "valid_until": "2026-05-10T03:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T02:35:05.693Z",
      "x_nadsec_last_seen": "2026-04-08T02:35:05.693Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-08T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--407a13c2-37d3-4f4b-9a6a-738d71c439ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T03:05:10.000Z",
      "valid_until": "2026-05-10T03:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T02:32:40.938Z",
      "x_nadsec_last_seen": "2026-04-08T02:32:40.938Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-08T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=7482; asn_org=Asia Pacific On-line Service Inc.",
      "id": "indicator--75e4e3cd-78dc-45a0-aa26-33f807b33c02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '218.187.101.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T03:05:10.000Z",
      "valid_until": "2026-05-10T03:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T02:17:20.940Z",
      "x_nadsec_last_seen": "2026-04-08T02:19:25.685Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "7482"
      ],
      "x_nadsec_orgs": [
        "Asia Pacific On-line Service Inc."
      ]
    },
    {
      "created": "2026-04-08T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--bd64cd53-e032-45cc-aa31-dc2d3effd229",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T03:05:10.000Z",
      "valid_until": "2026-05-10T03:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T02:19:10.864Z",
      "x_nadsec_last_seen": "2026-04-26T03:47:30.407Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "1883"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-08T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mssqld; ports=1433; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--b6bc8845-fc1b-464f-881e-8b06f6aa94f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '8.134.159.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T03:05:10.000Z",
      "valid_until": "2026-05-10T03:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T02:58:53.457Z",
      "x_nadsec_last_seen": "2026-04-08T02:59:33.441Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ]
    },
    {
      "created": "2026-04-08T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--34de5013-3161-4628-a85d-e078dcb913b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '92.101.26.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T03:05:10.000Z",
      "valid_until": "2026-05-10T03:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-08T02:26:34.803Z",
      "x_nadsec_last_seen": "2026-04-08T02:26:34.914Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-08T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--b2e25214-65bd-45c9-8e05-863f29f01468",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.194.159.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T05:05:10.000Z",
      "valid_until": "2026-05-10T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T04:05:44.192Z",
      "x_nadsec_last_seen": "2026-04-08T04:07:49.941Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-04-08T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--c4430f63-2c9a-4520-8d58-29890c406cf4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.8.178.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T05:05:10.000Z",
      "valid_until": "2026-05-10T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T04:55:19.061Z",
      "x_nadsec_last_seen": "2026-04-08T04:57:24.028Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-04-08T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--fc7cbb89-38a4-409b-9a9f-57e8c06659cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '187.251.242.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T05:05:10.000Z",
      "valid_until": "2026-05-10T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-08T04:07:06.881Z",
      "x_nadsec_last_seen": "2026-04-08T04:07:07.147Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-04-08T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=46; services=smbd; ports=445; cc=ES; asn=41608; asn_org=NextGenWebs, S.L.",
      "id": "indicator--5acdc39d-2ca0-49c8-acee-3254da1f6b87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.170.172.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T05:05:10.000Z",
      "valid_until": "2026-05-10T05:05:09.000Z",
      "x_nadsec_event_count": 271,
      "x_nadsec_first_seen": "2026-04-08T04:50:39.069Z",
      "x_nadsec_last_seen": "2026-04-23T18:18:14.456Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "41608"
      ],
      "x_nadsec_orgs": [
        "NextGenWebs, S.L."
      ]
    },
    {
      "created": "2026-04-08T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--7ac3e886-c209-476c-bd17-4f18786e99a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T05:05:10.000Z",
      "valid_until": "2026-05-10T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-08T04:45:32.804Z",
      "x_nadsec_last_seen": "2026-04-10T03:53:32.912Z",
      "x_nadsec_ports": [
        "445",
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-08T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--15fae536-a8e6-469b-824c-0328a263bff5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T05:05:10.000Z",
      "valid_until": "2026-05-10T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T04:30:11.784Z",
      "x_nadsec_last_seen": "2026-04-08T04:30:11.784Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-08T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--17f662d7-3d0b-452b-998d-e96b12668db5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T05:05:10.000Z",
      "valid_until": "2026-05-10T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T04:30:11.201Z",
      "x_nadsec_last_seen": "2026-04-08T04:30:11.201Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-08T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--078326bb-4688-4a71-9716-4ad5821b62cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T05:05:10.000Z",
      "valid_until": "2026-05-10T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T04:45:32.486Z",
      "x_nadsec_last_seen": "2026-04-08T04:45:32.486Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-08T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--164c359f-966e-4df8-ae3c-600cf131ecb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T05:05:10.000Z",
      "valid_until": "2026-05-10T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-08T04:41:41.879Z",
      "x_nadsec_last_seen": "2026-04-21T20:46:17.271Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-08T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--6efdcd75-78ac-46dd-af89-c2b7b9c905a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T05:05:10.000Z",
      "valid_until": "2026-05-10T05:05:09.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-04-08T04:10:42.138Z",
      "x_nadsec_last_seen": "2026-04-23T03:41:15.837Z",
      "x_nadsec_ports": [
        "81",
        "445",
        "1723"
      ],
      "x_nadsec_services": [
        "httpd",
        "smbd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-08T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=8402; asn_org=PVimpelCom",
      "id": "indicator--2915214a-2d99-4521-996e-82da7faa3990",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '78.107.131.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T05:05:10.000Z",
      "valid_until": "2026-05-10T05:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-08T04:38:46.597Z",
      "x_nadsec_last_seen": "2026-04-08T07:45:15.942Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8402"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-04-08T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=136636; asn_org=Sharplink Wireless Solution Pvt Ltd",
      "id": "indicator--c8a205e4-5948-4ea0-8b51-5ceedffa107d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.101.108.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T06:05:02.000Z",
      "valid_until": "2026-05-10T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T05:55:45.833Z",
      "x_nadsec_last_seen": "2026-04-08T05:55:54.245Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "136636"
      ],
      "x_nadsec_orgs": [
        "Sharplink Wireless Solution Pvt Ltd"
      ]
    },
    {
      "created": "2026-04-08T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=133278; asn_org=Dehradun Enet Solutions Private Ltd",
      "id": "indicator--cbcdf3f0-4d9d-4762-b17b-1e9d4cfc64de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.113.39.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T06:05:02.000Z",
      "valid_until": "2026-05-10T06:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-08T05:18:59.115Z",
      "x_nadsec_last_seen": "2026-04-19T00:14:21.329Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133278"
      ],
      "x_nadsec_orgs": [
        "Dehradun Enet Solutions Private Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-08T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mqttd; ports=1883; cc=FR; asn=211590; asn_org=Bucklog SARL",
      "id": "indicator--586c21ef-e022-4361-89f2-7a01879f7a02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.177.72.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T06:05:02.000Z",
      "valid_until": "2026-05-10T06:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-08T05:29:41.403Z",
      "x_nadsec_last_seen": "2026-04-08T05:29:42.561Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "211590"
      ],
      "x_nadsec_orgs": [
        "Bucklog SARL"
      ]
    },
    {
      "created": "2026-04-08T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--f74e206b-9437-42c0-984f-7d0851ad893b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T06:05:02.000Z",
      "valid_until": "2026-05-10T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T05:48:57.492Z",
      "x_nadsec_last_seen": "2026-04-08T05:48:57.492Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-04-08T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--7faab1fa-8822-4d41-82ce-6547ad8e6aa8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.14.73.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T06:05:02.000Z",
      "valid_until": "2026-05-10T06:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-08T05:58:50.994Z",
      "x_nadsec_last_seen": "2026-04-08T05:59:01.137Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-08T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=49301; asn_org=Joint Stock Company TransTeleCom",
      "id": "indicator--de0a2141-0e84-4f6f-9cdc-e7df7bfb2174",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '62.249.129.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T06:05:02.000Z",
      "valid_until": "2026-05-10T06:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-08T05:06:43.291Z",
      "x_nadsec_last_seen": "2026-04-08T05:06:43.688Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "49301"
      ],
      "x_nadsec_orgs": [
        "Joint Stock Company TransTeleCom"
      ]
    },
    {
      "created": "2026-04-08T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--fc280feb-f7ac-4669-b400-b58b1b5dc32a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T06:05:02.000Z",
      "valid_until": "2026-05-10T06:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-08T05:12:55.070Z",
      "x_nadsec_last_seen": "2026-04-19T12:31:58.847Z",
      "x_nadsec_ports": [
        "445",
        "1723"
      ],
      "x_nadsec_services": [
        "smbd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-08T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--8d0b92d9-c2ea-4253-840d-a8b38f8ef340",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T07:05:05.000Z",
      "valid_until": "2026-05-10T07:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-08T06:56:40.939Z",
      "x_nadsec_last_seen": "2026-04-08T06:57:36.923Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-08T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--887cf9b6-545a-476b-8be6-2475a927d245",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T07:05:05.000Z",
      "valid_until": "2026-05-10T07:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T06:57:33.474Z",
      "x_nadsec_last_seen": "2026-04-08T06:57:33.474Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-08T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--5fc664c4-9b02-4d2d-bbb4-c7d9c213cebd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T07:05:05.000Z",
      "valid_until": "2026-05-10T07:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-08T06:56:42.672Z",
      "x_nadsec_last_seen": "2026-04-08T06:57:18.284Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-08T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--4aa2dcfb-f640-486d-ada9-49347e2c9343",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T07:05:05.000Z",
      "valid_until": "2026-05-10T07:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-08T06:56:47.817Z",
      "x_nadsec_last_seen": "2026-04-08T06:57:00.484Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-08T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--66c47865-1184-41a5-9814-e6c8a8e7b403",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T07:05:05.000Z",
      "valid_until": "2026-05-10T07:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-08T06:56:58.748Z",
      "x_nadsec_last_seen": "2026-04-08T06:57:13.361Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-08T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--d1c8d585-456e-4948-b5bc-f110a1c2b127",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T07:05:05.000Z",
      "valid_until": "2026-05-10T07:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T06:56:54.736Z",
      "x_nadsec_last_seen": "2026-04-08T06:57:09.382Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-08T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--63c85f5f-f8f3-470e-86f6-8c5d5e8d4ca7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T07:05:05.000Z",
      "valid_until": "2026-05-10T07:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T06:57:11.117Z",
      "x_nadsec_last_seen": "2026-04-08T06:57:11.117Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-08T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--beb9b60b-b7e7-4bee-9544-a8e750172457",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T07:05:05.000Z",
      "valid_until": "2026-05-10T07:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-08T06:56:38.331Z",
      "x_nadsec_last_seen": "2026-04-08T06:57:26.602Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-08T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--ece9cc9a-82da-44a7-b4f2-3828b7628597",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T07:05:05.000Z",
      "valid_until": "2026-05-10T07:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-08T06:57:31.756Z",
      "x_nadsec_last_seen": "2026-04-08T06:57:35.205Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-08T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--27720235-27d3-4957-a0d2-d843eed19eab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T07:05:05.000Z",
      "valid_until": "2026-05-10T07:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-08T06:57:02.676Z",
      "x_nadsec_last_seen": "2026-04-08T06:57:30.038Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-08T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--a7b098e2-bf19-4ba1-88d2-b4099ae759b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T07:05:05.000Z",
      "valid_until": "2026-05-10T07:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T06:56:49.552Z",
      "x_nadsec_last_seen": "2026-04-08T06:57:28.320Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-08T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--dca530c7-c5e0-41d7-9609-6bc2f0f97044",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T07:05:05.000Z",
      "valid_until": "2026-05-10T07:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-08T06:57:07.646Z",
      "x_nadsec_last_seen": "2026-04-08T06:57:24.445Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-08T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=58495; asn_org=PT Parsaoran Global Datatrans",
      "id": "indicator--15d75750-f1aa-4732-85f9-93ead2be7ee4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.192.12.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T07:05:05.000Z",
      "valid_until": "2026-05-10T07:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T06:51:05.351Z",
      "x_nadsec_last_seen": "2026-04-08T06:51:10.068Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "58495"
      ],
      "x_nadsec_orgs": [
        "PT Parsaoran Global Datatrans"
      ]
    },
    {
      "created": "2026-04-08T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--2c512dc7-22a0-4be8-950e-abc0aa08ec5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.224.203.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T07:05:05.000Z",
      "valid_until": "2026-05-10T07:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T07:04:41.654Z",
      "x_nadsec_last_seen": "2026-04-08T07:06:46.515Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-08T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--6b229a95-96b8-42f1-a3ef-6c19c983bf4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '180.253.45.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T07:05:05.000Z",
      "valid_until": "2026-05-10T07:05:04.000Z",
      "x_nadsec_event_count": 45,
      "x_nadsec_first_seen": "2026-04-08T06:10:57.227Z",
      "x_nadsec_last_seen": "2026-04-08T06:12:47.929Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-08T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--4bca23de-50c9-4487-b139-ea704de8126a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.202.117.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T07:05:05.000Z",
      "valid_until": "2026-05-10T07:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T06:40:58.054Z",
      "x_nadsec_last_seen": "2026-04-08T06:41:04.511Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-08T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.",
      "id": "indicator--96199207-705d-4f19-959a-3d53c9a0a8bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '200.45.94.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T07:05:05.000Z",
      "valid_until": "2026-05-10T07:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-08T06:15:30.379Z",
      "x_nadsec_last_seen": "2026-04-08T06:22:50.357Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7303"
      ],
      "x_nadsec_orgs": [
        "Telecom Argentina S.A."
      ]
    },
    {
      "created": "2026-04-08T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KG; asn=12997; asn_org=OJSC Kyrgyztelecom",
      "id": "indicator--13b4fda0-522a-46aa-875f-d38173d12119",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '213.145.157.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T07:05:05.000Z",
      "valid_until": "2026-05-10T07:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T06:08:23.565Z",
      "x_nadsec_last_seen": "2026-04-08T06:10:30.665Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KG"
      ],
      "x_nadsec_asns": [
        "12997"
      ],
      "x_nadsec_orgs": [
        "OJSC Kyrgyztelecom"
      ]
    },
    {
      "created": "2026-04-08T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=149575; asn_org=SITI VISION DATA SOLUTIONS PRIVATE LIMITED",
      "id": "indicator--73425714-c45b-43d2-a69f-4a0351ff2b31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.187.79.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T08:05:10.000Z",
      "valid_until": "2026-05-10T08:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T07:41:03.191Z",
      "x_nadsec_last_seen": "2026-04-08T07:41:08.702Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "149575"
      ],
      "x_nadsec_orgs": [
        "SITI VISION DATA SOLUTIONS PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-04-08T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=136384; asn_org=Optix Pakistan Pvt. Limited",
      "id": "indicator--3cdc132d-9929-4d9b-9748-71749461ecec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.86.53.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T08:05:10.000Z",
      "valid_until": "2026-05-10T08:05:08.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-08T07:27:20.796Z",
      "x_nadsec_last_seen": "2026-04-30T18:14:28.015Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "136384"
      ],
      "x_nadsec_orgs": [
        "Optix Pakistan Pvt. Limited"
      ]
    },
    {
      "created": "2026-04-08T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--223f94b9-bd16-4e18-876e-2ea98c029685",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '157.230.121.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T08:05:10.000Z",
      "valid_until": "2026-05-10T08:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-08T07:44:34.537Z",
      "x_nadsec_last_seen": "2026-04-08T07:44:45.860Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-08T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=17451; asn_org=BIZNET NETWORKS",
      "id": "indicator--8eb307cf-afce-4a77-9668-8d5059db3c36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.253.104.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T08:05:10.000Z",
      "valid_until": "2026-05-10T08:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-08T07:39:32.649Z",
      "x_nadsec_last_seen": "2026-04-08T07:46:00.869Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17451"
      ],
      "x_nadsec_orgs": [
        "BIZNET NETWORKS"
      ]
    },
    {
      "created": "2026-04-08T09:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--7655b28d-9823-4404-ac21-2a5bf4d58042",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T09:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.22.42.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:05:06.000Z",
      "valid_until": "2026-05-10T09:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T09:03:54.528Z",
      "x_nadsec_last_seen": "2026-04-08T09:06:00.575Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-04-08T09:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=NL; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--141e2abe-8c9a-4fe1-9921-ccff713d56d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T09:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.190.29.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:05:06.000Z",
      "valid_until": "2026-05-10T09:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T08:22:15.736Z",
      "x_nadsec_last_seen": "2026-04-08T08:22:15.736Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-08T09:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e53b8332-05d7-4b79-a008-9ad19c50ab4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T09:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.227.139.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:05:06.000Z",
      "valid_until": "2026-05-10T09:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T08:38:52.580Z",
      "x_nadsec_last_seen": "2026-04-08T08:38:52.580Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-08T09:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ec5a4754-1dda-4137-ba5b-1046155ff7c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T09:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.202.122.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:05:06.000Z",
      "valid_until": "2026-05-10T09:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-08T08:56:11.755Z",
      "x_nadsec_last_seen": "2026-04-08T08:56:12.125Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-08T09:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23974; asn_org=Ministry of education",
      "id": "indicator--0fc7ce3e-53c3-410d-bfd3-26e524ad9978",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T09:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '203.172.218.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:05:06.000Z",
      "valid_until": "2026-05-10T09:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T08:17:41.019Z",
      "x_nadsec_last_seen": "2026-04-08T08:19:45.757Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23974"
      ],
      "x_nadsec_orgs": [
        "Ministry of education"
      ]
    },
    {
      "created": "2026-04-08T09:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--5a3ba493-2f0d-4450-bc8a-2d421d9414ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T09:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.22.172.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:05:06.000Z",
      "valid_until": "2026-05-10T09:05:04.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-08T08:49:33.931Z",
      "x_nadsec_last_seen": "2026-04-28T04:42:10.860Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-04-08T09:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b244d925-f849-4a51-bca0-5d4535183f26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T09:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.202.9.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:05:06.000Z",
      "valid_until": "2026-05-10T09:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-08T08:19:25.160Z",
      "x_nadsec_last_seen": "2026-04-29T09:07:05.424Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-08T09:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--96127c12-74be-407b-ba93-210edacf52ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T09:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.67.5.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:05:06.000Z",
      "valid_until": "2026-05-10T09:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T08:10:38.160Z",
      "x_nadsec_last_seen": "2026-04-08T08:14:41.898Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-08T09:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--ccfc493a-0a23-46f8-bc0d-50fcb399c635",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T09:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.84.136.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:05:06.000Z",
      "valid_until": "2026-05-10T09:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T08:49:03.172Z",
      "x_nadsec_last_seen": "2026-04-08T08:49:03.172Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-08T09:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--a3e896ce-231f-47c5-9814-643979b06f9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T09:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.240.236.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:05:06.000Z",
      "valid_until": "2026-05-10T09:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-08T08:21:52.651Z",
      "x_nadsec_last_seen": "2026-04-29T01:03:17.009Z",
      "x_nadsec_ports": [
        "3306",
        "27017",
        "21"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-04-08T09:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=US; asn=14103; asn_org=ACD.net",
      "id": "indicator--8fab25a5-bca5-4b86-a78b-c491f7c1a9da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T09:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '69.2.27.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:05:06.000Z",
      "valid_until": "2026-05-10T09:05:04.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-08T08:22:45.996Z",
      "x_nadsec_last_seen": "2026-04-08T08:59:32.863Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14103"
      ],
      "x_nadsec_orgs": [
        "ACD.net"
      ]
    },
    {
      "created": "2026-04-08T09:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=42396; asn_org=PJSC Telesystems of Ukraine",
      "id": "indicator--6d9d6191-2d9e-4a26-b914-f203ce09f5e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T09:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '77.109.20.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:05:06.000Z",
      "valid_until": "2026-05-10T09:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T08:55:02.192Z",
      "x_nadsec_last_seen": "2026-04-08T08:57:08.522Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "42396"
      ],
      "x_nadsec_orgs": [
        "PJSC Telesystems of Ukraine"
      ]
    },
    {
      "created": "2026-04-08T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=56041; asn_org=China Mobile communications corporation",
      "id": "indicator--dd9f7f0b-74f5-4c2e-830c-b022ef223628",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '111.3.28.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:05:11.000Z",
      "valid_until": "2026-05-10T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T09:11:55.096Z",
      "x_nadsec_last_seen": "2026-04-08T09:12:24.865Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56041"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-04-08T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--62dbfa40-9415-4d7a-b14a-6a3db082d1b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '112.206.64.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:05:11.000Z",
      "valid_until": "2026-05-10T10:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-08T09:22:38.531Z",
      "x_nadsec_last_seen": "2026-04-08T09:29:41.244Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-04-08T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--cdce0844-8b72-45cc-b2c2-19619ef8036b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '123.27.74.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:05:11.000Z",
      "valid_until": "2026-05-10T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T09:27:40.790Z",
      "x_nadsec_last_seen": "2026-04-08T09:29:45.589Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-08T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--1368571f-2dc1-4418-8492-e4f2c66afe83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.235.58.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:05:11.000Z",
      "valid_until": "2026-05-10T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T09:25:09.274Z",
      "x_nadsec_last_seen": "2026-04-08T09:27:14.062Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-08T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--67f4226b-02d2-4490-8663-2e68948d4c3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '150.107.38.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:05:11.000Z",
      "valid_until": "2026-05-10T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T09:56:54.600Z",
      "x_nadsec_last_seen": "2026-04-08T09:56:54.600Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-08T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--9fb1b7be-de3f-4b17-9c8f-f0762cccc70b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '157.230.209.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:05:11.000Z",
      "valid_until": "2026-05-10T10:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-08T09:56:40.943Z",
      "x_nadsec_last_seen": "2026-04-19T03:09:05.259Z",
      "x_nadsec_ports": [
        "3306",
        "1883",
        "1433",
        "27017"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mqttd",
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-08T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--c69f9b17-ccf7-4bbd-89ae-837db1946a1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '159.223.111.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:05:11.000Z",
      "valid_until": "2026-05-10T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T09:56:34.241Z",
      "x_nadsec_last_seen": "2026-04-08T09:56:34.241Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-08T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--58a1cee7-e7c0-489d-b353-cd2ebe756aec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '180.250.196.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:05:11.000Z",
      "valid_until": "2026-05-10T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T10:03:23.665Z",
      "x_nadsec_last_seen": "2026-04-30T23:44:43.608Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-08T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--cbc23f0a-6773-43b2-8673-721265c6a7f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '77.40.53.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:05:11.000Z",
      "valid_until": "2026-05-10T10:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-08T09:10:51.847Z",
      "x_nadsec_last_seen": "2026-04-08T09:18:37.953Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-08T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=263561; asn_org=RODRIGO BORGHI DA SILVA & CIA LTDA",
      "id": "indicator--77cd0580-1265-4955-869e-abc3112424ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.251.15.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T11:05:11.000Z",
      "valid_until": "2026-05-10T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T10:55:30.782Z",
      "x_nadsec_last_seen": "2026-04-08T10:57:37.427Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "263561"
      ],
      "x_nadsec_orgs": [
        "RODRIGO BORGHI DA SILVA & CIA LTDA"
      ]
    },
    {
      "created": "2026-04-08T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IT; asn=3269; asn_org=TIM",
      "id": "indicator--2864b943-3886-4b2c-9272-398d6e57c116",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '2.115.130.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T11:05:11.000Z",
      "valid_until": "2026-05-10T11:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-08T10:21:05.703Z",
      "x_nadsec_last_seen": "2026-04-08T10:21:08.834Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "3269"
      ],
      "x_nadsec_orgs": [
        "TIM"
      ]
    },
    {
      "created": "2026-04-08T12:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--91e275e7-bae7-4688-bf29-0bb1df517b2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T12:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '122.176.151.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T12:05:07.000Z",
      "valid_until": "2026-05-10T12:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T11:38:52.093Z",
      "x_nadsec_last_seen": "2026-04-08T11:40:57.183Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-04-08T12:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mqttd; ports=1883; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0434ecf6-7866-4d84-be09-af09c837b114",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T12:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.182.149.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T12:05:07.000Z",
      "valid_until": "2026-05-10T12:05:03.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-04-08T11:13:42.483Z",
      "x_nadsec_last_seen": "2026-04-08T11:13:46.627Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-08T12:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--75db9821-b035-4361-a40c-89648f8bb581",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T12:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.176.87.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T12:05:07.000Z",
      "valid_until": "2026-05-10T12:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-08T11:37:00.318Z",
      "x_nadsec_last_seen": "2026-04-08T11:45:28.280Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-04-08T12:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--d8553f65-41b7-4e0f-bd13-8f403eb44d35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T12:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.69.64.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T12:05:07.000Z",
      "valid_until": "2026-05-10T12:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T11:14:55.562Z",
      "x_nadsec_last_seen": "2026-04-08T11:17:01.955Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-08T12:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.; user(top)=a*******s; pass(top)=a********@",
      "id": "indicator--f66dcea3-8627-4714-a9f9-0c5f2f9c21b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T12:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.97.26.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T12:05:07.000Z",
      "valid_until": "2026-05-10T12:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T11:06:14.372Z",
      "x_nadsec_last_seen": "2026-04-08T11:06:14.372Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-04-08T12:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--04fea1e9-03de-4f8a-b35c-85e0903a7296",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T12:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '183.83.176.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T12:05:07.000Z",
      "valid_until": "2026-05-10T12:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T11:14:32.390Z",
      "x_nadsec_last_seen": "2026-04-08T11:16:38.377Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-04-08T12:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=13767; asn_org=DataBank Holdings, Ltd.",
      "id": "indicator--4174a518-a30f-4a3d-83d5-6dc9715a4191",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T12:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.18.11.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T12:05:07.000Z",
      "valid_until": "2026-05-10T12:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T11:09:31.157Z",
      "x_nadsec_last_seen": "2026-04-29T19:48:57.190Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "13767"
      ],
      "x_nadsec_orgs": [
        "DataBank Holdings, Ltd."
      ]
    },
    {
      "created": "2026-04-08T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=24835; asn_org=RAYA Telecom - Egypt",
      "id": "indicator--ab93690a-759e-4ec9-bf49-5418d390f9ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.189.67.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T13:05:10.000Z",
      "valid_until": "2026-05-10T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T12:23:56.919Z",
      "x_nadsec_last_seen": "2026-04-08T12:26:03.471Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24835"
      ],
      "x_nadsec_orgs": [
        "RAYA Telecom - Egypt"
      ]
    },
    {
      "created": "2026-04-08T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=63490; asn_org=PT Artha Media Lintas Nusa",
      "id": "indicator--0ad61949-5a16-450d-a1c1-026950fe9a2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.93.237.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T13:05:10.000Z",
      "valid_until": "2026-05-10T13:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-08T12:25:17.503Z",
      "x_nadsec_last_seen": "2026-04-08T12:32:09.516Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "63490"
      ],
      "x_nadsec_orgs": [
        "PT Artha Media Lintas Nusa"
      ]
    },
    {
      "created": "2026-04-08T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=10029; asn_org=SHYAM SPECTRA PVT LTD",
      "id": "indicator--d268cbc5-90ed-4669-87a6-c10dfc606146",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '119.82.72.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T13:05:10.000Z",
      "valid_until": "2026-05-10T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T12:05:26.221Z",
      "x_nadsec_last_seen": "2026-04-08T12:07:31.986Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "10029"
      ],
      "x_nadsec_orgs": [
        "SHYAM SPECTRA PVT LTD"
      ]
    },
    {
      "created": "2026-04-08T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=NG; asn=37340; asn_org=Spectranet",
      "id": "indicator--3c682076-d096-4ec7-ab6f-a2bc939f0f36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.118.34.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T13:05:10.000Z",
      "valid_until": "2026-05-10T13:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-08T12:20:39.188Z",
      "x_nadsec_last_seen": "2026-04-08T12:28:00.281Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "37340"
      ],
      "x_nadsec_orgs": [
        "Spectranet"
      ]
    },
    {
      "created": "2026-04-08T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--63e05af9-773b-4604-b700-84fe65c3b5bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T13:05:10.000Z",
      "valid_until": "2026-05-10T13:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-08T12:09:11.176Z",
      "x_nadsec_last_seen": "2026-04-14T01:54:47.628Z",
      "x_nadsec_ports": [
        "81",
        "21"
      ],
      "x_nadsec_services": [
        "httpd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-08T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--9a992da8-0669-40c0-9ada-304d14552518",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T13:05:10.000Z",
      "valid_until": "2026-05-10T13:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-08T12:17:52.817Z",
      "x_nadsec_last_seen": "2026-04-30T15:43:52.448Z",
      "x_nadsec_ports": [
        "3306",
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-08T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--5fe5535c-49ed-4a05-a297-58debb5f8d26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T13:05:10.000Z",
      "valid_until": "2026-05-10T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-08T12:05:51.157Z",
      "x_nadsec_last_seen": "2026-04-28T03:01:24.651Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-08T14:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=135752; asn_org=Evoke Digital Solutions",
      "id": "indicator--1937c082-f160-4301-9200-7cd564736055",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T14:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.73.189.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:05:21.000Z",
      "valid_until": "2026-05-10T14:05:17.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-08T13:38:37.918Z",
      "x_nadsec_last_seen": "2026-04-23T03:08:13.420Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135752"
      ],
      "x_nadsec_orgs": [
        "Evoke Digital Solutions"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-08T14:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=45916; asn_org=Gujarat Telelink Pvt Ltd",
      "id": "indicator--2910ce39-a374-458a-ba7e-5eba129c148c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T14:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.85.8.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:05:21.000Z",
      "valid_until": "2026-05-10T14:05:17.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-08T13:50:40.100Z",
      "x_nadsec_last_seen": "2026-04-08T14:12:35.377Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45916"
      ],
      "x_nadsec_orgs": [
        "Gujarat Telelink Pvt Ltd"
      ]
    },
    {
      "created": "2026-04-08T14:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=KE; asn=33771; asn_org=SAFARICOM-LIMITED",
      "id": "indicator--47ace88d-961c-48d3-8fa1-f717c1347b15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T14:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '105.161.99.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:05:21.000Z",
      "valid_until": "2026-05-10T14:05:17.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-08T13:18:36.460Z",
      "x_nadsec_last_seen": "2026-04-08T13:26:53.870Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "33771"
      ],
      "x_nadsec_orgs": [
        "SAFARICOM-LIMITED"
      ]
    },
    {
      "created": "2026-04-08T14:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--d3e6338e-f0be-4b91-b21e-3e348c498769",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T14:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:05:21.000Z",
      "valid_until": "2026-05-10T14:05:17.000Z",
      "x_nadsec_event_count": 34,
      "x_nadsec_first_seen": "2026-04-08T13:31:52.075Z",
      "x_nadsec_last_seen": "2026-04-29T14:51:38.267Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-04-08T14:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=262807; asn_org=Redfox Telecomunicacoes Ltda.; user(top)=**",
      "id": "indicator--c02235f8-2a5c-488f-9afe-a624ab862450",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T14:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.250.52.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:05:21.000Z",
      "valid_until": "2026-05-10T14:05:17.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T13:12:06.236Z",
      "x_nadsec_last_seen": "2026-04-08T13:12:06.236Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262807"
      ],
      "x_nadsec_orgs": [
        "Redfox Telecomunicacoes Ltda."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-08T14:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=27951; asn_org=Media Commerce Partners S.A",
      "id": "indicator--6d8714d0-856d-45c4-b305-1b57f3ce92e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T14:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.14.239.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:05:21.000Z",
      "valid_until": "2026-05-10T14:05:17.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T13:37:15.921Z",
      "x_nadsec_last_seen": "2026-04-08T13:39:22.666Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "27951"
      ],
      "x_nadsec_orgs": [
        "Media Commerce Partners S.A"
      ]
    },
    {
      "created": "2026-04-08T14:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=4230; asn_org=CLARO S.A.",
      "id": "indicator--976ed7fb-565b-4a36-be45-ccddbe4eff22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T14:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '200.210.71.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:05:21.000Z",
      "valid_until": "2026-05-10T14:05:17.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T13:14:11.960Z",
      "x_nadsec_last_seen": "2026-04-08T13:16:18.516Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "4230"
      ],
      "x_nadsec_orgs": [
        "CLARO S.A."
      ]
    },
    {
      "created": "2026-04-08T14:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=mongod; ports=27017; cc=SG; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--278d8cca-c6c4-4771-ac8e-ee050e618953",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T14:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.255.223.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:05:21.000Z",
      "valid_until": "2026-05-10T14:05:17.000Z",
      "x_nadsec_event_count": 19,
      "x_nadsec_first_seen": "2026-04-08T14:02:32.245Z",
      "x_nadsec_last_seen": "2026-04-17T12:05:25.606Z",
      "x_nadsec_ports": [
        "27017",
        "21"
      ],
      "x_nadsec_services": [
        "mongod",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-08T14:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PT; asn=15525; asn_org=Servicos De Comunicacoes E Multimedia S.A.",
      "id": "indicator--6bf66e43-7c0e-441b-8f25-efc930cf0f1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T14:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '62.48.209.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:05:21.000Z",
      "valid_until": "2026-05-10T14:05:17.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T13:30:25.367Z",
      "x_nadsec_last_seen": "2026-04-08T13:32:31.214Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "15525"
      ],
      "x_nadsec_orgs": [
        "Servicos De Comunicacoes E Multimedia S.A."
      ]
    },
    {
      "created": "2026-04-08T14:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--30b43fe2-ee1b-4799-b868-cf7be8d237a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T14:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:05:21.000Z",
      "valid_until": "2026-05-10T14:05:17.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-08T13:53:55.133Z",
      "x_nadsec_last_seen": "2026-04-16T14:40:54.912Z",
      "x_nadsec_ports": [
        "1723",
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-08T14:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--38ec0345-51da-4144-9816-545b366fb01a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T14:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:05:21.000Z",
      "valid_until": "2026-05-10T14:05:17.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-07T00:57:27.952Z",
      "x_nadsec_last_seen": "2026-04-25T13:36:38.209Z",
      "x_nadsec_ports": [
        "445",
        "1883",
        "21",
        "81"
      ],
      "x_nadsec_services": [
        "mqttd",
        "smbd",
        "ftpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-08T14:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--c467ebbc-6e57-48cc-83f0-bb172787f2e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T14:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:05:21.000Z",
      "valid_until": "2026-05-10T14:05:17.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T13:30:59.267Z",
      "x_nadsec_last_seen": "2026-04-08T13:30:59.267Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-08T14:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=60246; asn_org=Consumer Internet Cooperative PG-19",
      "id": "indicator--11bed669-8f64-486c-bc52-f0a05a755caa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T14:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '95.174.125.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:05:21.000Z",
      "valid_until": "2026-05-10T14:05:17.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-08T13:12:04.387Z",
      "x_nadsec_last_seen": "2026-04-08T13:19:03.046Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "60246"
      ],
      "x_nadsec_orgs": [
        "Consumer Internet Cooperative PG-19"
      ]
    },
    {
      "created": "2026-04-08T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=epmapper; ports=135; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--f949460b-3cc0-48cf-a8dc-7d95931e0c42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.133.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:05:10.000Z",
      "valid_until": "2026-05-10T16:05:08.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-08T15:23:55.433Z",
      "x_nadsec_last_seen": "2026-04-08T15:24:35.430Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-08T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=12; services=mirrorc; ports=34813; cc=MX; asn=265523; asn_org=Sierra Madre Internet SA de CV",
      "id": "indicator--c2d499ce-bd9a-4bab-b67f-104629804ebc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '177.125.137.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:05:10.000Z",
      "valid_until": "2026-05-10T16:05:08.000Z",
      "x_nadsec_event_count": 2741,
      "x_nadsec_first_seen": "2026-04-08T15:26:56.940Z",
      "x_nadsec_last_seen": "2026-04-28T20:31:11.861Z",
      "x_nadsec_ports": [
        "42",
        "34661",
        "33099",
        "33233",
        "33267",
        "33579",
        "33637",
        "33695",
        "33705",
        "33743"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "265523"
      ],
      "x_nadsec_orgs": [
        "Sierra Madre Internet SA de CV"
      ]
    },
    {
      "created": "2026-04-08T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--7b51d1e4-e0d6-4cae-a0fc-59ed16249437",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:05:10.000Z",
      "valid_until": "2026-05-10T16:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T15:37:32.570Z",
      "x_nadsec_last_seen": "2026-04-08T15:37:32.570Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-08T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--bf1b9def-ff0c-4015-9477-2d81adea6427",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:05:10.000Z",
      "valid_until": "2026-05-10T16:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-08T15:41:41.471Z",
      "x_nadsec_last_seen": "2026-04-08T15:41:51.631Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-08T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--11f89c53-590a-48cb-a8ff-11615816e110",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:05:10.000Z",
      "valid_until": "2026-05-10T16:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T16:02:17.676Z",
      "x_nadsec_last_seen": "2026-04-08T16:02:17.676Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-08T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--755ff90e-ffda-4469-94eb-dec279f5fbe5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.91.182.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:05:10.000Z",
      "valid_until": "2026-05-10T16:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-08T15:19:55.983Z",
      "x_nadsec_last_seen": "2026-04-08T15:20:33.508Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-08T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--fc2823d7-dd7f-4490-afba-ba981f900fa3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.237.125.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:05:10.000Z",
      "valid_until": "2026-05-10T17:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-08T16:41:13.997Z",
      "x_nadsec_last_seen": "2026-04-08T16:41:24.186Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-08T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--562aabdf-6d0c-4843-867a-35fca7f60d92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:05:10.000Z",
      "valid_until": "2026-05-10T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T16:37:43.522Z",
      "x_nadsec_last_seen": "2026-04-08T16:37:43.522Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-08T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e5c1bfc3-6266-42b6-952d-1006eecc9bd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T18:05:10.000Z",
      "valid_until": "2026-05-10T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T17:17:13.830Z",
      "x_nadsec_last_seen": "2026-04-08T17:17:13.830Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-08T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BO; asn=27839; asn_org=Comteco Ltda",
      "id": "indicator--129e247b-d385-4229-8a4d-e1e5e7402b1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '200.58.87.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T18:05:10.000Z",
      "valid_until": "2026-05-10T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T17:10:25.453Z",
      "x_nadsec_last_seen": "2026-04-08T17:12:32.484Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "27839"
      ],
      "x_nadsec_orgs": [
        "Comteco Ltda"
      ]
    },
    {
      "created": "2026-04-08T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--c7ecb27b-0b2f-4e0c-ade6-5d05fee36403",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.26.233.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T18:05:10.000Z",
      "valid_until": "2026-05-10T18:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-08T17:56:34.911Z",
      "x_nadsec_last_seen": "2026-04-08T18:05:18.111Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-04-08T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--7c05d323-d3ec-46d8-8ad6-cd66b432eed0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.147.40.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T18:05:10.000Z",
      "valid_until": "2026-05-10T18:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-08T17:54:51.565Z",
      "x_nadsec_last_seen": "2026-04-08T17:56:57.159Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-08T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=764; services=smbd; ports=445; cc=BR; asn=264111; asn_org=RedeBr Telecom",
      "id": "indicator--0c474e9c-adca-4422-aeda-0ce4b404f9f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.97.14.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T19:05:10.000Z",
      "valid_until": "2026-05-10T19:05:08.000Z",
      "x_nadsec_event_count": 3151,
      "x_nadsec_first_seen": "2026-04-08T18:40:02.439Z",
      "x_nadsec_last_seen": "2026-04-08T19:51:09.116Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "264111"
      ],
      "x_nadsec_orgs": [
        "RedeBr Telecom"
      ]
    },
    {
      "created": "2026-04-08T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--ce650b63-fea8-4a55-93f0-4961fc213cfa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.191.223.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T19:05:10.000Z",
      "valid_until": "2026-05-10T19:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-08T18:27:54.309Z",
      "x_nadsec_last_seen": "2026-04-08T18:34:33.368Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-08T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=50852; asn_org=INTERRA Ltd.",
      "id": "indicator--378434d0-c1cd-4d24-8f21-fde2dcdbf805",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.247.23.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T19:05:10.000Z",
      "valid_until": "2026-05-10T19:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-08T18:37:45.514Z",
      "x_nadsec_last_seen": "2026-04-08T18:39:51.334Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "50852"
      ],
      "x_nadsec_orgs": [
        "INTERRA Ltd."
      ]
    },
    {
      "created": "2026-04-08T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--559d689b-c6f6-492f-8521-fdaac6ad0b3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T19:05:10.000Z",
      "valid_until": "2026-05-10T19:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T19:00:23.868Z",
      "x_nadsec_last_seen": "2026-04-08T19:00:23.868Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-08T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d8794691-efc9-4242-bb28-ba21a06acdb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T19:05:10.000Z",
      "valid_until": "2026-05-10T19:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T18:10:07.041Z",
      "x_nadsec_last_seen": "2026-04-08T18:10:07.041Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-08T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--19749206-44ab-41d6-831a-76658776d58a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T19:05:10.000Z",
      "valid_until": "2026-05-10T19:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-08T18:09:43.163Z",
      "x_nadsec_last_seen": "2026-04-29T18:02:03.881Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-08T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--6c08eead-da85-4d0e-ac72-d21910aac870",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T19:05:10.000Z",
      "valid_until": "2026-05-10T19:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T18:10:07.456Z",
      "x_nadsec_last_seen": "2026-04-08T18:10:07.456Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-08T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=httpd; ports=81; cc=US; asn=210558; asn_org=1337 Services GmbH",
      "id": "indicator--12d6b640-172b-4bbb-9073-567b36269d11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '124.198.131.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T20:05:10.000Z",
      "valid_until": "2026-05-10T20:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-08T19:13:19.796Z",
      "x_nadsec_last_seen": "2026-04-08T19:13:31.093Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "210558"
      ],
      "x_nadsec_orgs": [
        "1337 Services GmbH"
      ]
    },
    {
      "created": "2026-04-08T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--5d8bbebd-b3f9-4380-8921-9c82603a21cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.182.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T20:05:10.000Z",
      "valid_until": "2026-05-10T20:05:08.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-04-08T19:32:29.283Z",
      "x_nadsec_last_seen": "2026-04-12T19:37:04.528Z",
      "x_nadsec_ports": [
        "21",
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-08T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--388a2a48-fffd-4c99-acab-dd06ecd412e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.36.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T20:05:10.000Z",
      "valid_until": "2026-05-10T20:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-08T19:18:57.559Z",
      "x_nadsec_last_seen": "2026-04-19T17:59:30.311Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-08T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--019e465b-6221-4882-9bec-a08dd19313b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.232.138.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T20:05:10.000Z",
      "valid_until": "2026-05-10T20:05:08.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-04-08T19:25:35.873Z",
      "x_nadsec_last_seen": "2026-04-08T19:27:43.779Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-08T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--5cc299d2-d9e4-4ce0-af20-d5856c91ab7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T20:05:10.000Z",
      "valid_until": "2026-05-10T20:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T19:40:24.342Z",
      "x_nadsec_last_seen": "2026-04-19T13:24:16.002Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-04-08T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=httpd; ports=81; cc=US; asn=210558; asn_org=1337 Services GmbH",
      "id": "indicator--badbe13b-2b4c-4a18-9281-0f1ff9086c67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '192.159.99.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T20:05:10.000Z",
      "valid_until": "2026-05-10T20:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-08T19:18:13.242Z",
      "x_nadsec_last_seen": "2026-04-08T19:18:30.858Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "210558"
      ],
      "x_nadsec_orgs": [
        "1337 Services GmbH"
      ]
    },
    {
      "created": "2026-04-08T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--d2533351-c9a2-4280-9356-8d3520b37e4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.76.35.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T20:05:10.000Z",
      "valid_until": "2026-05-10T20:05:08.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-02T17:34:54.260Z",
      "x_nadsec_last_seen": "2026-04-25T09:50:36.541Z",
      "x_nadsec_ports": [
        "27017",
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "mongod",
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-04-08T21:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=GB; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--8f315ffb-c305-4a20-a5ab-4b499914effc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T21:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.193.64.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T21:05:11.000Z",
      "valid_until": "2026-05-10T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T20:09:13.180Z",
      "x_nadsec_last_seen": "2026-04-08T20:09:32.991Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-08T21:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=136199; asn_org=CHINANET Guangdong province Yuedong MAN network",
      "id": "indicator--32c1806f-6b80-401b-9da8-dc48c1fda43c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T21:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '219.130.137.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T21:05:11.000Z",
      "valid_until": "2026-05-10T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-08T20:10:22.926Z",
      "x_nadsec_last_seen": "2026-04-08T20:10:47.226Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "136199"
      ],
      "x_nadsec_orgs": [
        "CHINANET Guangdong province Yuedong MAN network"
      ]
    },
    {
      "created": "2026-04-08T21:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited; user(top)=**",
      "id": "indicator--f039a0eb-f639-4e33-a3eb-5af01cb20c27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T21:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '223.206.39.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T21:05:11.000Z",
      "valid_until": "2026-05-10T21:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-08T20:33:48.497Z",
      "x_nadsec_last_seen": "2026-04-08T20:33:56.146Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-08T21:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CM; asn=36905; asn_org=Creolink",
      "id": "indicator--6d045f19-5571-476a-9bfc-e2bf37ddd8eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T21:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.205.77.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T21:05:11.000Z",
      "valid_until": "2026-05-10T21:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-08T20:39:24.588Z",
      "x_nadsec_last_seen": "2026-04-08T20:46:48.801Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CM"
      ],
      "x_nadsec_asns": [
        "36905"
      ],
      "x_nadsec_orgs": [
        "Creolink"
      ]
    },
    {
      "created": "2026-04-08T21:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=58765; asn_org=B TEL INTERNET PRIVATE LIMITED",
      "id": "indicator--fbfbffd7-14fc-4a21-add9-22e16062be5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T21:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.113.91.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T21:05:11.000Z",
      "valid_until": "2026-05-10T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T21:00:44.502Z",
      "x_nadsec_last_seen": "2026-04-08T21:02:49.328Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "58765"
      ],
      "x_nadsec_orgs": [
        "B TEL INTERNET PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-04-08T21:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--40a506a1-7e67-4fd6-9a94-02c87cc1adfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T21:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T21:05:11.000Z",
      "valid_until": "2026-05-10T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T20:47:40.141Z",
      "x_nadsec_last_seen": "2026-04-09T15:32:46.373Z",
      "x_nadsec_ports": [
        "445",
        "1883",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "mongod",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-08T21:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--52b5379c-8d03-47a1-b2d2-c284c5d5bce0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T21:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T21:05:11.000Z",
      "valid_until": "2026-05-10T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T20:40:29.567Z",
      "x_nadsec_last_seen": "2026-04-08T20:40:29.567Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-08T21:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--b66e3e22-4883-470e-bf14-b666c7fe7f95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T21:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T21:05:11.000Z",
      "valid_until": "2026-05-10T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T20:59:50.711Z",
      "x_nadsec_last_seen": "2026-04-08T20:59:50.711Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-08T21:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--88d96bf6-e547-4c29-85f8-486a3ba3b4ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T21:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T21:05:11.000Z",
      "valid_until": "2026-05-10T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T21:00:01.013Z",
      "x_nadsec_last_seen": "2026-04-08T21:00:01.013Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-08T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=38264; asn_org=National WiMAXIMS environment",
      "id": "indicator--c8fa2d56-2df4-4b0b-8339-4d4b85cb3da8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '110.39.18.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T22:05:13.000Z",
      "valid_until": "2026-05-10T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T21:38:07.273Z",
      "x_nadsec_last_seen": "2026-04-08T21:40:13.280Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "38264"
      ],
      "x_nadsec_orgs": [
        "National WiMAXIMS environment"
      ]
    },
    {
      "created": "2026-04-08T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--2a90d400-c1bf-43f1-bb19-ddad8f64233e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T22:05:13.000Z",
      "valid_until": "2026-05-10T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T21:59:37.810Z",
      "x_nadsec_last_seen": "2026-04-08T21:59:37.810Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-08T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=24863; asn_org=LINKdotNET",
      "id": "indicator--ad28cb45-c98a-4d94-98f5-3df2df0e8e1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.178.54.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T22:05:13.000Z",
      "valid_until": "2026-05-10T22:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-08T21:20:41.226Z",
      "x_nadsec_last_seen": "2026-04-08T21:27:47.411Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24863"
      ],
      "x_nadsec_orgs": [
        "LINKdotNET"
      ]
    },
    {
      "created": "2026-04-08T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--4f2e996a-8c0b-46f8-9bff-07117b9abf72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.23.153.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T22:05:13.000Z",
      "valid_until": "2026-05-10T22:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-04-08T21:12:25.913Z",
      "x_nadsec_last_seen": "2026-04-08T21:16:49.500Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "3306",
        "27017",
        "45239"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-08T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--0cfac61a-7b2c-448c-8445-8c760a7b97c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '71.6.199.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T22:05:13.000Z",
      "valid_until": "2026-05-10T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T21:58:05.879Z",
      "x_nadsec_last_seen": "2026-04-08T21:58:05.879Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-04-08T23:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=24378; asn_org=Total Access Communication PLC.",
      "id": "indicator--97f9918f-6398-46ec-a078-e60a9f682c63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T23:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.47.215.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T23:05:12.000Z",
      "valid_until": "2026-05-10T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T22:53:40.718Z",
      "x_nadsec_last_seen": "2026-04-08T22:53:45.886Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "24378"
      ],
      "x_nadsec_orgs": [
        "Total Access Communication PLC."
      ]
    },
    {
      "created": "2026-04-08T23:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=140006; asn_org=RSUP DR KARIADI",
      "id": "indicator--f4ac4730-420a-44e8-a21f-780aa925d2a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T23:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.148.235.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T23:05:12.000Z",
      "valid_until": "2026-05-10T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T22:37:08.565Z",
      "x_nadsec_last_seen": "2026-04-08T22:40:33.127Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "140006"
      ],
      "x_nadsec_orgs": [
        "RSUP DR KARIADI"
      ]
    },
    {
      "created": "2026-04-08T23:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=26599; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--b323bc15-1403-4a2f-bca3-4493c60a42f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T23:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '179.118.199.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T23:05:12.000Z",
      "valid_until": "2026-05-10T23:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-04-01T15:38:23.848Z",
      "x_nadsec_last_seen": "2026-04-09T08:17:37.133Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "26599"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-04-08T23:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--1c8d69d9-74c0-4f4e-8aae-d8de80430d82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T23:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.8.162.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T23:05:12.000Z",
      "valid_until": "2026-05-10T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T22:17:08.769Z",
      "x_nadsec_last_seen": "2026-04-08T22:17:08.769Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-04-08T23:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--5253f5af-7e3b-4c42-9c43-bf7a22bc7273",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T23:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.8.183.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T23:05:12.000Z",
      "valid_until": "2026-05-10T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T22:10:39.273Z",
      "x_nadsec_last_seen": "2026-04-08T22:17:09.434Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-04-08T23:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--9afe541c-6721-4634-b526-7b2b90deba15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T23:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.219.72.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T23:05:12.000Z",
      "valid_until": "2026-05-10T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T22:19:55.592Z",
      "x_nadsec_last_seen": "2026-04-16T19:09:23.828Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-08T23:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--964f8e6b-a4e8-42e2-921b-70af00cbe8d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T23:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T23:05:12.000Z",
      "valid_until": "2026-05-10T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T22:09:55.160Z",
      "x_nadsec_last_seen": "2026-04-08T22:09:55.160Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-08T23:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--46db8633-34a9-4b11-9ee4-2e5c1ac55cb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T23:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T23:05:12.000Z",
      "valid_until": "2026-05-10T23:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-05T00:25:36.673Z",
      "x_nadsec_last_seen": "2026-04-08T22:57:30.568Z",
      "x_nadsec_ports": [
        "21",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-08T23:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--1b7ff201-66bd-40cf-870e-a931acfa6fa1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T23:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T23:05:12.000Z",
      "valid_until": "2026-05-10T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T23:04:42.685Z",
      "x_nadsec_last_seen": "2026-04-08T23:04:42.685Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-08T23:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--e97147ab-04c3-4dc0-b5f0-0a62b751b1a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T23:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '49.206.237.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T23:05:12.000Z",
      "valid_until": "2026-05-10T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T22:05:19.199Z",
      "x_nadsec_last_seen": "2026-04-08T22:07:24.229Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-04-08T23:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--653a046c-050d-4855-b05c-5e7f8fdb5282",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T23:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '77.40.50.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T23:05:12.000Z",
      "valid_until": "2026-05-10T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T23:00:48.887Z",
      "x_nadsec_last_seen": "2026-04-08T23:02:55.910Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-09T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mysqld; ports=3306; cc=HK; asn=45753; asn_org=Netsec Limited",
      "id": "indicator--83daa9e9-a8f4-4ef2-95c2-d7f2753a9413",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.16.77.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T00:05:14.000Z",
      "valid_until": "2026-05-11T00:05:13.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-04-08T23:17:53.714Z",
      "x_nadsec_last_seen": "2026-04-08T23:17:57.282Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "45753"
      ],
      "x_nadsec_orgs": [
        "Netsec Limited"
      ]
    },
    {
      "created": "2026-04-09T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--579a6cde-b708-43d0-9ac4-a921d05da757",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.64.106.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T00:05:14.000Z",
      "valid_until": "2026-05-11T00:05:13.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-08T23:57:14.970Z",
      "x_nadsec_last_seen": "2026-04-08T23:57:14.970Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-09T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--2bced7fa-be4b-4e5f-b88a-2ced3e70d8f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '13.222.210.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T01:05:10.000Z",
      "valid_until": "2026-05-11T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T00:55:10.931Z",
      "x_nadsec_last_seen": "2026-04-09T00:55:10.931Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-09T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--827fbe40-164d-4a57-b840-a6e82cfbb1ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '183.141.43.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T01:05:10.000Z",
      "valid_until": "2026-05-11T01:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-09T00:05:19.910Z",
      "x_nadsec_last_seen": "2026-04-09T00:12:28.669Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-09T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--10c785ad-b1aa-40d9-8c3b-01ccc59f1c6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T01:05:10.000Z",
      "valid_until": "2026-05-11T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T00:20:20.736Z",
      "x_nadsec_last_seen": "2026-04-09T00:20:20.736Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-09T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--42eb2472-a28c-4388-9be1-c63438f26396",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.40.218.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T01:05:10.000Z",
      "valid_until": "2026-05-11T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T00:31:25.424Z",
      "x_nadsec_last_seen": "2026-04-09T00:31:25.424Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-09T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17426; asn_org=Primesoftex Ltd",
      "id": "indicator--8b268aa8-3b1c-439b-9daa-9e24d0f52922",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '203.115.96.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T01:05:10.000Z",
      "valid_until": "2026-05-11T01:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-09T00:34:03.061Z",
      "x_nadsec_last_seen": "2026-04-09T01:15:13.892Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17426"
      ],
      "x_nadsec_orgs": [
        "Primesoftex Ltd"
      ]
    },
    {
      "created": "2026-04-09T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--0a3e135f-3c74-4584-8609-b250b8440a50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.182.132.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:05:11.000Z",
      "valid_until": "2026-05-11T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T02:26:58.489Z",
      "x_nadsec_last_seen": "2026-04-09T02:29:03.307Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-09T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--edd61559-b63f-4eee-ae00-76ba703f605c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '115.147.46.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:05:11.000Z",
      "valid_until": "2026-05-11T03:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-09T02:00:16.607Z",
      "x_nadsec_last_seen": "2026-04-09T02:56:12.916Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-04-09T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**; pass(top)=!*******e",
      "id": "indicator--0bbc9abc-f896-4a64-8815-9ad0a737a56b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '122.224.201.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:05:11.000Z",
      "valid_until": "2026-05-11T03:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-04-09T02:57:00.229Z",
      "x_nadsec_last_seen": "2026-04-09T02:57:51.339Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "!*******e"
      ]
    },
    {
      "created": "2026-04-09T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mongod; ports=27017; cc=GB; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--60b8b2ec-389c-4896-aac4-0fdcd229f91d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '161.35.175.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:05:11.000Z",
      "valid_until": "2026-05-11T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T02:32:44.972Z",
      "x_nadsec_last_seen": "2026-04-09T02:33:09.374Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-09T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--fbe71223-e8aa-4952-bead-61f598b2da49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.163.61.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:05:11.000Z",
      "valid_until": "2026-05-11T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T02:18:41.649Z",
      "x_nadsec_last_seen": "2026-04-29T02:08:04.381Z",
      "x_nadsec_ports": [
        "21",
        "81"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-09T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--7d23486c-15cf-4b8b-9a85-304f7e39b207",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '219.147.36.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:05:11.000Z",
      "valid_until": "2026-05-11T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T02:11:12.736Z",
      "x_nadsec_last_seen": "2026-04-09T02:13:20.144Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-09T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--ad7724f4-bdc3-489f-82c4-cbbb984b87c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.83.30.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:05:11.000Z",
      "valid_until": "2026-05-11T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T02:31:55.675Z",
      "x_nadsec_last_seen": "2026-04-09T02:34:01.084Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-09T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--b1136318-a0ff-4a82-b0bc-1538303084e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:05:11.000Z",
      "valid_until": "2026-05-11T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T03:04:49.125Z",
      "x_nadsec_last_seen": "2026-04-09T03:04:49.125Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-09T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--99cc663e-1d02-4987-89b1-db98b61e0a5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:05:11.000Z",
      "valid_until": "2026-05-11T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-09T03:04:48.922Z",
      "x_nadsec_last_seen": "2026-04-14T13:51:44.565Z",
      "x_nadsec_ports": [
        "21",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-09T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=62314; asn_org=Atmospherica Ltd.",
      "id": "indicator--b9a9b498-8651-42c4-8d6e-22483ad8c0ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '93.171.178.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:05:11.000Z",
      "valid_until": "2026-05-11T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T02:05:48.435Z",
      "x_nadsec_last_seen": "2026-04-25T10:18:19.157Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "62314"
      ],
      "x_nadsec_orgs": [
        "Atmospherica Ltd."
      ]
    },
    {
      "created": "2026-04-09T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--1109fdcc-632a-4587-adfa-34a6cce678ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.173.106.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T05:05:13.000Z",
      "valid_until": "2026-05-11T05:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T04:10:45.059Z",
      "x_nadsec_last_seen": "2026-04-09T04:12:50.602Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-04-09T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b299e86e-d3c4-44a8-8b25-5dab2b0f0cd1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.237.124.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T05:05:13.000Z",
      "valid_until": "2026-05-11T05:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T04:20:15.291Z",
      "x_nadsec_last_seen": "2026-04-09T04:20:15.291Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-09T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=9905; asn_org=Linknet ASN",
      "id": "indicator--b45bafb0-c0b7-45aa-b046-a7d2cf6be622",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '139.255.45.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T05:05:13.000Z",
      "valid_until": "2026-05-11T05:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-09T04:16:24.627Z",
      "x_nadsec_last_seen": "2026-04-09T04:23:03.045Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9905"
      ],
      "x_nadsec_orgs": [
        "Linknet ASN"
      ]
    },
    {
      "created": "2026-04-09T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--b51da822-ec60-4e8f-aca9-161e12005b28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.97.148.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T05:05:13.000Z",
      "valid_until": "2026-05-11T05:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-09T04:56:15.464Z",
      "x_nadsec_last_seen": "2026-04-09T04:58:20.015Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-04-09T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=ftpd; ports=21; cc=US; asn=14956; asn_org=RouterHosting LLC; user(top)=d****n; pass(top)=x***p",
      "id": "indicator--4c7c73b2-07cd-4408-afa4-95b59526e248",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '144.172.112.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T05:05:13.000Z",
      "valid_until": "2026-05-11T05:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-09T04:39:52.867Z",
      "x_nadsec_last_seen": "2026-04-09T04:47:04.887Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "d****n"
      ],
      "x_nadsec_passwords_attempted": [
        "x***p"
      ]
    },
    {
      "created": "2026-04-09T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=10139; asn_org=Smart Broadband, Inc.",
      "id": "indicator--6da07184-5f78-41f2-b295-26fdc8195f67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '175.176.45.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T05:05:13.000Z",
      "valid_until": "2026-05-11T05:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T04:14:34.601Z",
      "x_nadsec_last_seen": "2026-04-09T04:16:41.833Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "10139"
      ],
      "x_nadsec_orgs": [
        "Smart Broadband, Inc."
      ]
    },
    {
      "created": "2026-04-09T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--801bea5f-58ee-492e-a82a-bbfdd973810d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T05:05:13.000Z",
      "valid_until": "2026-05-11T05:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T04:13:45.862Z",
      "x_nadsec_last_seen": "2026-04-09T04:13:45.862Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-09T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--3c9f1f25-1827-4405-9714-0ff7958b64e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '2.63.249.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T05:05:13.000Z",
      "valid_until": "2026-05-11T05:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-09T04:47:40.115Z",
      "x_nadsec_last_seen": "2026-04-09T04:53:23.463Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-09T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--808e41a1-9d93-48c8-9560-06e7eedd145a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T05:05:13.000Z",
      "valid_until": "2026-05-11T05:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T04:54:32.395Z",
      "x_nadsec_last_seen": "2026-04-09T04:54:32.395Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-04-09T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--e0320ab6-96de-49f6-8f2b-afc569747eb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '58.58.176.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T05:05:13.000Z",
      "valid_until": "2026-05-11T05:05:11.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-04-09T04:49:07.506Z",
      "x_nadsec_last_seen": "2026-04-09T04:51:57.531Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-09T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=141870; asn_org=GV REDDY BROADBAND SERVICES",
      "id": "indicator--2efcc425-274b-4c9f-aee3-ec7aba8c4764",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.165.62.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T06:05:10.000Z",
      "valid_until": "2026-05-11T06:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-09T05:42:49.983Z",
      "x_nadsec_last_seen": "2026-04-09T05:49:19.976Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "141870"
      ],
      "x_nadsec_orgs": [
        "GV REDDY BROADBAND SERVICES"
      ]
    },
    {
      "created": "2026-04-09T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--4671ae32-0b5a-4d2f-87d1-57cf70302f7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.164.79.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T06:05:10.000Z",
      "valid_until": "2026-05-11T06:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T05:35:29.807Z",
      "x_nadsec_last_seen": "2026-04-09T05:37:34.607Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-09T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--84237c65-456a-4993-9307-06b92106568c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.133.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T06:05:10.000Z",
      "valid_until": "2026-05-11T06:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-09T05:09:58.683Z",
      "x_nadsec_last_seen": "2026-04-09T05:10:08.689Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-09T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--c4d874a3-0f0f-4df1-95ab-108ae1d65f55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.254.158.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T06:05:10.000Z",
      "valid_until": "2026-05-11T06:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T05:48:02.084Z",
      "x_nadsec_last_seen": "2026-04-09T05:57:35.203Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-04-09T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CO; asn=262191; asn_org=LIBERTY NETWORKS DE COLOMBIA S.A.S; user(top)=**",
      "id": "indicator--5d9dff7c-8d36-4dd1-9dac-4433c7acb147",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.131.217.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T06:05:10.000Z",
      "valid_until": "2026-05-11T06:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T05:09:15.431Z",
      "x_nadsec_last_seen": "2026-04-09T05:09:15.431Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "262191"
      ],
      "x_nadsec_orgs": [
        "LIBERTY NETWORKS DE COLOMBIA S.A.S"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-09T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AR; asn=11664; asn_org=Techtel LMDS Comunicaciones Interactivas S.A.",
      "id": "indicator--49ff3054-1c76-4cd7-83bf-6da795f87d53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.221.178.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T06:05:10.000Z",
      "valid_until": "2026-05-11T06:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-09T05:56:04.338Z",
      "x_nadsec_last_seen": "2026-04-09T05:58:11.464Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "11664"
      ],
      "x_nadsec_orgs": [
        "Techtel LMDS Comunicaciones Interactivas S.A."
      ]
    },
    {
      "created": "2026-04-09T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AR; asn=11664; asn_org=Techtel LMDS Comunicaciones Interactivas S.A.",
      "id": "indicator--2955081c-8696-4a00-b4cb-f510b7cb6483",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '200.80.229.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T06:05:10.000Z",
      "valid_until": "2026-05-11T06:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T05:56:04.711Z",
      "x_nadsec_last_seen": "2026-04-09T05:56:04.711Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "11664"
      ],
      "x_nadsec_orgs": [
        "Techtel LMDS Comunicaciones Interactivas S.A."
      ]
    },
    {
      "created": "2026-04-09T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--21950104-d0e0-49b5-be6e-65cd710f3f2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T06:05:10.000Z",
      "valid_until": "2026-05-11T06:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-09T05:34:27.053Z",
      "x_nadsec_last_seen": "2026-04-29T10:32:54.922Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-09T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--db7d927a-4b0e-48fc-91c2-3c9f9a3a4d05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '71.6.199.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T06:05:10.000Z",
      "valid_until": "2026-05-11T06:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-09T05:10:21.851Z",
      "x_nadsec_last_seen": "2026-04-15T10:33:31.526Z",
      "x_nadsec_ports": [
        "445",
        "27017",
        "1433"
      ],
      "x_nadsec_services": [
        "mongod",
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-04-09T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=CA; asn=12989; asn_org=Black HOST Ltd; user(top)=a*******s; pass(top)=a********@",
      "id": "indicator--c8d7f83e-5f8d-42ba-99ed-cdb3b5ded5c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '86.54.31.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T06:05:10.000Z",
      "valid_until": "2026-05-11T06:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-09T06:04:33.950Z",
      "x_nadsec_last_seen": "2026-04-23T01:20:08.242Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "12989"
      ],
      "x_nadsec_orgs": [
        "Black HOST Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-04-09T07:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--dab58844-5409-4919-a756-04c7f65092dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T07:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.232.164.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T07:05:12.000Z",
      "valid_until": "2026-05-11T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T06:11:02.024Z",
      "x_nadsec_last_seen": "2026-04-09T06:13:06.992Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-09T07:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=36; services=smbd; ports=445; cc=US; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--65c36a13-84d1-4198-846d-c043e4c7fc01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T07:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T07:05:12.000Z",
      "valid_until": "2026-05-11T07:05:09.000Z",
      "x_nadsec_event_count": 72,
      "x_nadsec_first_seen": "2026-04-09T06:30:22.684Z",
      "x_nadsec_last_seen": "2026-04-24T08:54:12.869Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-04-09T07:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=28233; asn_org=I-CONECTA REDES DE TELECOMUNICACAO EIRELI EPP",
      "id": "indicator--7a990a90-5c65-4a83-97be-8f59206478c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T07:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.127.60.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T07:05:12.000Z",
      "valid_until": "2026-05-11T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-09T06:47:20.180Z",
      "x_nadsec_last_seen": "2026-04-09T06:52:31.194Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28233"
      ],
      "x_nadsec_orgs": [
        "I-CONECTA REDES DE TELECOMUNICACAO EIRELI EPP"
      ]
    },
    {
      "created": "2026-04-09T07:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--128ecc76-3253-4ae5-b3c7-38d11b1062e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T07:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T07:05:12.000Z",
      "valid_until": "2026-05-11T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T06:22:01.848Z",
      "x_nadsec_last_seen": "2026-04-09T06:22:01.848Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-09T07:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--5ab6f81a-4765-4397-b057-a3f2be46a4fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T07:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '223.207.235.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T07:05:12.000Z",
      "valid_until": "2026-05-11T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T06:40:00.197Z",
      "x_nadsec_last_seen": "2026-04-09T06:42:04.631Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-04-09T07:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--2349e68f-5f6a-4da4-9347-da0395dd62e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T07:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '67.205.128.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T07:05:12.000Z",
      "valid_until": "2026-05-11T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T06:15:00.346Z",
      "x_nadsec_last_seen": "2026-04-09T06:15:00.346Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-09T07:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IT; asn=8075; asn_org=Microsoft Corporation; user(top)=**",
      "id": "indicator--fa17d55c-4b8a-49e0-a0c1-68c01b77fd6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T07:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '72.146.33.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T07:05:12.000Z",
      "valid_until": "2026-05-11T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T06:23:05.674Z",
      "x_nadsec_last_seen": "2026-04-09T06:23:05.674Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-09T07:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=AZ; asn=207251; asn_org=CASPEL LLC; user(top)=**",
      "id": "indicator--61a40e57-20cd-46a5-b550-c45c66a13fe4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T07:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.132.42.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T07:05:12.000Z",
      "valid_until": "2026-05-11T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-09T06:34:59.496Z",
      "x_nadsec_last_seen": "2026-04-12T10:18:11.897Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "207251"
      ],
      "x_nadsec_orgs": [
        "CASPEL LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-09T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--405b936b-724a-44c9-95ec-e115459c5141",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '114.104.189.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T09:05:12.000Z",
      "valid_until": "2026-05-11T09:05:09.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-04-09T08:23:17.793Z",
      "x_nadsec_last_seen": "2026-04-09T08:23:31.476Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6"
      ]
    },
    {
      "created": "2026-04-09T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mongod; ports=27017; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--794bf065-70ab-4c6a-a293-32ba888bf194",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '139.59.245.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T09:05:12.000Z",
      "valid_until": "2026-05-11T09:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-04-09T08:38:15.559Z",
      "x_nadsec_last_seen": "2026-04-09T08:42:09.219Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017",
        "36471"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-09T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--549956b9-5a42-478c-8940-7881a5dbeffe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.176.117.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T09:05:12.000Z",
      "valid_until": "2026-05-11T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T08:06:41.588Z",
      "x_nadsec_last_seen": "2026-04-20T09:36:19.698Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-04-09T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=18978; asn_org=Enzu Inc; user(top)=**",
      "id": "indicator--187b48b7-a60f-48ee-9416-bceba37f0cf0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '38.127.61.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T09:05:12.000Z",
      "valid_until": "2026-05-11T09:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-09T08:09:26.558Z",
      "x_nadsec_last_seen": "2026-04-09T08:09:28.235Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "18978"
      ],
      "x_nadsec_orgs": [
        "Enzu Inc"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-09T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NP; asn=23752; asn_org=Nepal Telecommunications Corporation, Internet Services",
      "id": "indicator--b1925266-7590-4cb5-aa56-655bc0093efb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '49.244.89.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T09:05:12.000Z",
      "valid_until": "2026-05-11T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T08:49:19.599Z",
      "x_nadsec_last_seen": "2026-04-09T08:51:25.346Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NP"
      ],
      "x_nadsec_asns": [
        "23752"
      ],
      "x_nadsec_orgs": [
        "Nepal Telecommunications Corporation, Internet Services"
      ]
    },
    {
      "created": "2026-04-09T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--59d3ae83-218a-4314-9574-c90a01b14925",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T09:05:12.000Z",
      "valid_until": "2026-05-11T09:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-09T08:14:01.731Z",
      "x_nadsec_last_seen": "2026-04-22T05:49:30.780Z",
      "x_nadsec_ports": [
        "81",
        "1883"
      ],
      "x_nadsec_services": [
        "httpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-09T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--56a9d4fd-d536-428c-8c25-64c55bfbebe6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '116.172.248.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T10:05:11.000Z",
      "valid_until": "2026-05-11T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T09:54:06.728Z",
      "x_nadsec_last_seen": "2026-04-09T09:54:06.728Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-04-09T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--ef78c7dd-31e4-44af-8dab-8f099fa3a117",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '159.223.169.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T10:05:11.000Z",
      "valid_until": "2026-05-11T10:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-04-09T10:02:24.341Z",
      "x_nadsec_last_seen": "2026-04-19T08:08:39.928Z",
      "x_nadsec_ports": [
        "1883",
        "1433",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mssqld",
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-09T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--4a7486a4-fe12-4ad3-a690-8757e30d9b49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.245.234.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T10:05:11.000Z",
      "valid_until": "2026-05-11T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T09:07:31.248Z",
      "x_nadsec_last_seen": "2026-04-09T09:07:31.248Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-09T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--4342f417-5b97-434c-9414-1cc23c1f5724",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T10:05:11.000Z",
      "valid_until": "2026-05-11T10:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-09T09:46:36.162Z",
      "x_nadsec_last_seen": "2026-04-28T12:48:17.821Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "1883",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd",
        "mongod",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-09T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VE; asn=11562; asn_org=Net Uno, C.A.",
      "id": "indicator--8cbd1adc-9a35-4f97-bc9b-ca1940ff1d4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.153.82.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T10:05:11.000Z",
      "valid_until": "2026-05-11T10:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-09T09:21:43.356Z",
      "x_nadsec_last_seen": "2026-04-09T09:28:29.826Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "11562"
      ],
      "x_nadsec_orgs": [
        "Net Uno, C.A."
      ]
    },
    {
      "created": "2026-04-09T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--dc7bf5c4-b723-40c9-a98e-5f1355e01913",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '211.137.77.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T10:05:11.000Z",
      "valid_until": "2026-05-11T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T09:53:45.678Z",
      "x_nadsec_last_seen": "2026-04-09T09:53:45.678Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-04-09T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=CH; asn=15169; asn_org=Google LLC",
      "id": "indicator--2d4b8455-841f-40f0-bd04-28519034dab8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.216.172.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T10:05:11.000Z",
      "valid_until": "2026-05-11T10:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-09T09:56:17.731Z",
      "x_nadsec_last_seen": "2026-04-29T23:41:15.492Z",
      "x_nadsec_ports": [
        "21",
        "445"
      ],
      "x_nadsec_services": [
        "ftpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "15169"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-09T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=31; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--fd54ec88-4d9e-4c8d-b2cd-fbda32a2b831",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.227.3.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T10:05:11.000Z",
      "valid_until": "2026-05-11T10:05:09.000Z",
      "x_nadsec_event_count": 31,
      "x_nadsec_first_seen": "2026-04-09T09:59:31.733Z",
      "x_nadsec_last_seen": "2026-04-09T10:02:21.077Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-09T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--99ef00f9-6a42-44b0-9fd5-8040812798e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '218.1.210.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T11:05:10.000Z",
      "valid_until": "2026-05-11T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T10:59:59.456Z",
      "x_nadsec_last_seen": "2026-04-09T11:02:06.262Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-04-09T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--279adb98-89e9-4f31-9813-682e893be55c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '60.249.188.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T11:05:10.000Z",
      "valid_until": "2026-05-11T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T10:06:32.710Z",
      "x_nadsec_last_seen": "2026-04-09T10:08:38.835Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-09T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TW; asn=3462; asn_org=Data Communication Business Group; user(top)=**",
      "id": "indicator--29cf73a4-b3cf-4936-b5e1-a1e068a31328",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '61.221.207.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T11:05:10.000Z",
      "valid_until": "2026-05-11T11:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T10:37:01.164Z",
      "x_nadsec_last_seen": "2026-04-09T10:37:01.164Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-09T13:06:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--3b345870-2f37-468b-86ad-ed9175c93a62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T13:06:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.224.187.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T13:06:04.000Z",
      "valid_until": "2026-05-11T13:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-09T12:25:14.654Z",
      "x_nadsec_last_seen": "2026-04-09T12:31:40.290Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-09T13:06:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=NL; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--d12a7517-f9cc-47d9-bae4-8e8c6eb0c356",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T13:06:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '188.166.107.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T13:06:04.000Z",
      "valid_until": "2026-05-11T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T12:27:32.274Z",
      "x_nadsec_last_seen": "2026-04-09T12:27:32.274Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-09T13:06:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EC; asn=27668; asn_org=ETAPA EP",
      "id": "indicator--62020b8c-9275-42aa-bc98-68342997f33c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T13:06:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '191.100.27.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T13:06:04.000Z",
      "valid_until": "2026-05-11T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T12:39:47.592Z",
      "x_nadsec_last_seen": "2026-04-09T12:41:53.632Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "27668"
      ],
      "x_nadsec_orgs": [
        "ETAPA EP"
      ]
    },
    {
      "created": "2026-04-09T13:06:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mongod; ports=27017; cc=ID; asn=138050; asn_org=Dinas Komunikasi Provins Jawa Barat",
      "id": "indicator--20d2f7d6-09c3-4390-a343-b0cd093662a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T13:06:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '202.58.242.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T13:06:04.000Z",
      "valid_until": "2026-05-11T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T12:42:21.806Z",
      "x_nadsec_last_seen": "2026-04-09T12:42:43.132Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "138050"
      ],
      "x_nadsec_orgs": [
        "Dinas Komunikasi Provins Jawa Barat"
      ]
    },
    {
      "created": "2026-04-09T13:06:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--9c7b833b-612d-4a6c-86bc-0392226b3c76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T13:06:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.233.88.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T13:06:04.000Z",
      "valid_until": "2026-05-11T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T12:28:56.191Z",
      "x_nadsec_last_seen": "2026-04-09T12:28:56.191Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-09T13:06:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--120a2b53-3849-4645-8945-f9272b91e848",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T13:06:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.91.45.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T13:06:04.000Z",
      "valid_until": "2026-05-11T13:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-09T12:40:43.102Z",
      "x_nadsec_last_seen": "2026-04-09T12:41:22.145Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-09T13:06:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--5d2329c1-ce7b-41a4-be33-6886be27cf93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T13:06:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '49.49.194.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T13:06:04.000Z",
      "valid_until": "2026-05-11T13:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-09T12:27:10.866Z",
      "x_nadsec_last_seen": "2026-04-09T12:27:10.955Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-04-09T13:06:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--01455fbf-3b68-433f-871b-b74502b4ae96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T13:06:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T13:06:04.000Z",
      "valid_until": "2026-05-11T13:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-09T12:51:29.055Z",
      "x_nadsec_last_seen": "2026-04-26T12:50:43.773Z",
      "x_nadsec_ports": [
        "445",
        "1883"
      ],
      "x_nadsec_services": [
        "smbd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-09T13:06:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--3ac5a14d-9380-4ac8-9092-2c6ea7f8cf9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T13:06:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T13:06:04.000Z",
      "valid_until": "2026-05-11T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T12:37:06.171Z",
      "x_nadsec_last_seen": "2026-04-09T12:37:06.171Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-09T13:06:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MK; asn=6821; asn_org=Makedonski Telekom AD-Skopje",
      "id": "indicator--11bdfed5-4c60-447f-b374-9bb3a45c7410",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T13:06:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '77.28.158.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T13:06:04.000Z",
      "valid_until": "2026-05-11T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T12:59:45.666Z",
      "x_nadsec_last_seen": "2026-04-09T12:59:56.281Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MK"
      ],
      "x_nadsec_asns": [
        "6821"
      ],
      "x_nadsec_orgs": [
        "Makedonski Telekom AD-Skopje"
      ]
    },
    {
      "created": "2026-04-09T13:06:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=200730; asn_org=ISAEV Igor",
      "id": "indicator--03158ee4-94e6-4caf-b5f6-e41755de1e25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T13:06:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.251.64.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T13:06:04.000Z",
      "valid_until": "2026-05-11T13:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-09T12:56:13.320Z",
      "x_nadsec_last_seen": "2026-04-12T12:37:11.881Z",
      "x_nadsec_ports": [
        "21",
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "200730"
      ],
      "x_nadsec_orgs": [
        "ISAEV Igor"
      ]
    },
    {
      "created": "2026-04-09T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--ed5d2a42-8b60-488d-8c56-73a09ac5e601",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '122.54.173.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T14:05:10.000Z",
      "valid_until": "2026-05-11T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T13:45:11.238Z",
      "x_nadsec_last_seen": "2026-04-09T13:47:15.871Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-04-09T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=MX; asn=8151; asn_org=UNINET; user(top)=**",
      "id": "indicator--6ca10e38-7bb4-4714-bcb7-ae13b7a9cf7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.135.160.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T14:05:10.000Z",
      "valid_until": "2026-05-11T14:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-09T13:32:44.617Z",
      "x_nadsec_last_seen": "2026-04-09T13:32:45.427Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-09T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--9c4825e7-ec68-4e7b-8e02-0c623b0604d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.38.195.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T14:05:10.000Z",
      "valid_until": "2026-05-11T14:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-09T13:26:34.673Z",
      "x_nadsec_last_seen": "2026-04-17T17:19:33.284Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-09T15:07:52.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ZA; asn=37457; asn_org=Telkom-Internet",
      "id": "indicator--73a1b1a8-9e69-494b-9501-edd75f3a43e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T15:07:52.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.251.44.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T15:07:52.000Z",
      "valid_until": "2026-05-11T15:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-09T14:11:23.609Z",
      "x_nadsec_last_seen": "2026-04-09T14:13:31.609Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "37457"
      ],
      "x_nadsec_orgs": [
        "Telkom-Internet"
      ]
    },
    {
      "created": "2026-04-09T15:07:52.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ZA; asn=37457; asn_org=Telkom-Internet",
      "id": "indicator--ac2a4188-80a7-4331-b675-e0288356e721",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T15:07:52.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.252.44.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T15:07:52.000Z",
      "valid_until": "2026-05-11T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T14:11:23.114Z",
      "x_nadsec_last_seen": "2026-04-09T14:11:23.114Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "37457"
      ],
      "x_nadsec_orgs": [
        "Telkom-Internet"
      ]
    },
    {
      "created": "2026-04-09T15:07:52.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--a943ac87-96b1-4b91-8718-ed2389a32a23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T15:07:52.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '116.96.47.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T15:07:52.000Z",
      "valid_until": "2026-05-11T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T14:34:40.459Z",
      "x_nadsec_last_seen": "2026-04-09T14:36:46.579Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-09T15:07:52.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=52974; asn_org=Henet Telecomunicacoes Ltda",
      "id": "indicator--f31c346a-8257-4477-9aee-67ff2d14821a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T15:07:52.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '131.0.88.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T15:07:52.000Z",
      "valid_until": "2026-05-11T15:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-09T14:59:19.256Z",
      "x_nadsec_last_seen": "2026-04-09T15:03:46.419Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52974"
      ],
      "x_nadsec_orgs": [
        "Henet Telecomunicacoes Ltda"
      ]
    },
    {
      "created": "2026-04-09T15:07:52.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--e4eddad1-8df4-4482-8bd0-a367dbab2d4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T15:07:52.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T15:07:52.000Z",
      "valid_until": "2026-05-11T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T14:25:02.042Z",
      "x_nadsec_last_seen": "2026-04-27T05:51:00.049Z",
      "x_nadsec_ports": [
        "135",
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-09T15:07:52.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--aa494324-c992-4f15-9f85-1e1d558609ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T15:07:52.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T15:07:52.000Z",
      "valid_until": "2026-05-11T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T14:30:43.106Z",
      "x_nadsec_last_seen": "2026-04-29T02:59:04.251Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "1883"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-09T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--67b38b69-78cd-4bf4-8eb7-f545f61eef61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.182.235.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T16:05:05.000Z",
      "valid_until": "2026-05-11T16:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-09T15:05:03.592Z",
      "x_nadsec_last_seen": "2026-04-09T15:05:06.749Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-09T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--04575384-76e9-4364-86f7-4a88cce6aec0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T16:05:05.000Z",
      "valid_until": "2026-05-11T16:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T15:47:32.447Z",
      "x_nadsec_last_seen": "2026-04-09T15:47:32.447Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-09T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=39824; asn_org=JSC Alma Telecommunications",
      "id": "indicator--8795b599-04b5-43bb-a0cc-4a44ed9757b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.36.143.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T16:05:05.000Z",
      "valid_until": "2026-05-11T16:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T15:11:16.263Z",
      "x_nadsec_last_seen": "2026-04-09T15:13:23.037Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "39824"
      ],
      "x_nadsec_orgs": [
        "JSC Alma Telecommunications"
      ]
    },
    {
      "created": "2026-04-09T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--7f58b2d2-a92f-44b0-ba82-793d734aba39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '95.37.223.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T16:05:05.000Z",
      "valid_until": "2026-05-11T16:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T15:14:26.208Z",
      "x_nadsec_last_seen": "2026-04-09T15:20:21.972Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-09T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=US; asn=212238; asn_org=Datacamp Limited",
      "id": "indicator--3a8b4bef-a48b-471d-8464-ebc1ce93ee34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '149.40.50.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T17:05:10.000Z",
      "valid_until": "2026-05-11T17:05:09.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-04-09T16:54:51.987Z",
      "x_nadsec_last_seen": "2026-04-09T16:57:12.315Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ]
    },
    {
      "created": "2026-04-09T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--b9e5c178-fa88-4bfc-8370-96af9025a5a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.104.11.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T17:05:10.000Z",
      "valid_until": "2026-05-11T17:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-09T16:50:21.690Z",
      "x_nadsec_last_seen": "2026-04-09T16:50:22.085Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-09T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=16; services=smbd; ports=445; cc=GB; asn=201579; asn_org=Hostgnome Ltd",
      "id": "indicator--56b60d0c-e779-482c-976c-711287847aad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.91.69.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T17:05:10.000Z",
      "valid_until": "2026-05-11T17:05:09.000Z",
      "x_nadsec_event_count": 134,
      "x_nadsec_first_seen": "2026-04-09T17:02:40.296Z",
      "x_nadsec_last_seen": "2026-04-09T17:43:36.384Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "201579"
      ],
      "x_nadsec_orgs": [
        "Hostgnome Ltd"
      ]
    },
    {
      "created": "2026-04-09T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--33ab3446-0f28-49dc-b9e3-7168d1e51bef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.29.56.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T17:05:10.000Z",
      "valid_until": "2026-05-11T17:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-09T16:19:29.753Z",
      "x_nadsec_last_seen": "2026-04-09T16:19:30.113Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-09T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--36adc0f7-2f56-4067-8bfb-dec6d65dfb19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.84.205.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T17:05:10.000Z",
      "valid_until": "2026-05-11T17:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-09T17:04:30.791Z",
      "x_nadsec_last_seen": "2026-04-09T17:04:54.341Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-09T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--8d541bff-f3c1-4a5f-8cbe-9874ce3b7012",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T17:05:10.000Z",
      "valid_until": "2026-05-11T17:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-08T14:44:58.349Z",
      "x_nadsec_last_seen": "2026-04-09T16:41:25.111Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-09T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=NL; asn=206264; asn_org=Amarutu Technology Ltd",
      "id": "indicator--13c0a493-3b8b-4191-afb2-dcc513536c91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '93.123.72.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T17:05:10.000Z",
      "valid_until": "2026-05-11T17:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-04-09T16:47:17.558Z",
      "x_nadsec_last_seen": "2026-04-13T02:18:43.469Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "206264"
      ],
      "x_nadsec_orgs": [
        "Amarutu Technology Ltd"
      ]
    },
    {
      "created": "2026-04-09T19:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=3816; asn_org=COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "id": "indicator--cb0a7bbd-9cf1-40ff-bc1f-83f7fb4b3264",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T19:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.200.235.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T19:05:08.000Z",
      "valid_until": "2026-05-11T19:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T18:53:40.883Z",
      "x_nadsec_last_seen": "2026-04-09T18:55:47.615Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "3816"
      ],
      "x_nadsec_orgs": [
        "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC"
      ]
    },
    {
      "created": "2026-04-09T19:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=httpd; ports=81; cc=IN; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--ba3c0a63-ef24-4189-bbb6-2da5c242558c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T19:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.158.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T19:05:08.000Z",
      "valid_until": "2026-05-11T19:05:03.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-09T19:02:21.386Z",
      "x_nadsec_last_seen": "2026-04-09T19:03:13.257Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-09T19:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=IN; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--0b3cab83-bd36-4bb3-a636-e53c701b214e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T19:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.159.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T19:05:08.000Z",
      "valid_until": "2026-05-11T19:05:03.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-04-09T18:36:55.969Z",
      "x_nadsec_last_seen": "2026-04-27T19:38:26.247Z",
      "x_nadsec_ports": [
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "pptpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-09T19:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=KR; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--30e6ba9c-80b4-497e-80a1-6da4792d7f34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T19:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.243.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T19:05:08.000Z",
      "valid_until": "2026-05-11T19:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-09T18:47:36.900Z",
      "x_nadsec_last_seen": "2026-04-09T18:47:59.808Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-09T19:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--c3fe591d-246f-408b-872d-ec0146ba132e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T19:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '161.35.59.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T19:05:08.000Z",
      "valid_until": "2026-05-11T19:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-09T18:10:43.780Z",
      "x_nadsec_last_seen": "2026-04-09T18:10:55.067Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-09T19:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--f38d7fe0-f202-4339-abbf-5c8f96bd04ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T19:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.38.70.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T19:05:08.000Z",
      "valid_until": "2026-05-11T19:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T18:49:04.918Z",
      "x_nadsec_last_seen": "2026-04-09T18:51:11.240Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-09T19:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=DO; asn=266798; asn_org=UNE COMUNICACIONES SRL",
      "id": "indicator--2c89171c-c7ef-4adf-b9f8-f5c8c7b9d844",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T19:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.235.228.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T19:05:08.000Z",
      "valid_until": "2026-05-11T19:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T18:14:58.806Z",
      "x_nadsec_last_seen": "2026-04-09T18:14:58.806Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DO"
      ],
      "x_nadsec_asns": [
        "266798"
      ],
      "x_nadsec_orgs": [
        "UNE COMUNICACIONES SRL"
      ]
    },
    {
      "created": "2026-04-09T19:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=DO; asn=266798; asn_org=UNE COMUNICACIONES SRL",
      "id": "indicator--41c98c99-501b-4d8c-ba86-b9b40477d211",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T19:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.235.228.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T19:05:08.000Z",
      "valid_until": "2026-05-11T19:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T18:14:58.595Z",
      "x_nadsec_last_seen": "2026-04-09T18:14:58.595Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DO"
      ],
      "x_nadsec_asns": [
        "266798"
      ],
      "x_nadsec_orgs": [
        "UNE COMUNICACIONES SRL"
      ]
    },
    {
      "created": "2026-04-09T19:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=UA; asn=201776; asn_org=Miranda-Media Ltd; user(top)=**",
      "id": "indicator--8a3a13e9-0c16-4c96-bf54-7c434467b63b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T19:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.115.201.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T19:05:08.000Z",
      "valid_until": "2026-05-11T19:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T18:07:07.452Z",
      "x_nadsec_last_seen": "2026-04-09T18:07:07.452Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "201776"
      ],
      "x_nadsec_orgs": [
        "Miranda-Media Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-09T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=HK; asn=132883; asn_org=TOPWAY GLOBAL LIMITED",
      "id": "indicator--042c07c1-734a-4d03-8b17-e2ffe654fa38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.27.108.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T21:05:05.000Z",
      "valid_until": "2026-05-11T21:05:03.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-09T20:25:35.243Z",
      "x_nadsec_last_seen": "2026-04-16T22:58:25.812Z",
      "x_nadsec_ports": [
        "1433",
        "27017"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mongod"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "132883"
      ],
      "x_nadsec_orgs": [
        "TOPWAY GLOBAL LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6"
      ]
    },
    {
      "created": "2026-04-09T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0598e181-ec0d-44a8-8574-460f8fd3ea8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.248.48.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T21:05:05.000Z",
      "valid_until": "2026-05-11T21:05:03.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-09T20:54:14.476Z",
      "x_nadsec_last_seen": "2026-04-19T03:09:05.263Z",
      "x_nadsec_ports": [
        "3306",
        "27017",
        "1433"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-09T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=httpd; ports=81; cc=NL; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--e52f12ce-e95f-403f-bcf7-9b3db2211858",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.224.128.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T21:05:05.000Z",
      "valid_until": "2026-05-11T21:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T20:29:53.665Z",
      "x_nadsec_last_seen": "2026-04-09T20:30:15.498Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-04-09T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MA; asn=36903; asn_org=MT-MPLS",
      "id": "indicator--5abce110-907e-4cbb-bf8c-95b5cef21ab9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.70.85.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T21:05:05.000Z",
      "valid_until": "2026-05-11T21:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T20:54:04.357Z",
      "x_nadsec_last_seen": "2026-04-09T20:56:10.882Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "36903"
      ],
      "x_nadsec_orgs": [
        "MT-MPLS"
      ]
    },
    {
      "created": "2026-04-09T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--cb927ac1-4d34-41d7-95a7-55b0b92ef083",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.19.5.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T21:05:05.000Z",
      "valid_until": "2026-05-11T21:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T20:30:11.138Z",
      "x_nadsec_last_seen": "2026-04-09T20:30:11.138Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-09T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=268552; asn_org=NETSBRASIL LTDA",
      "id": "indicator--9237ffca-9bdf-42e4-a11e-c048efd9fab9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.163.104.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T21:05:05.000Z",
      "valid_until": "2026-05-11T21:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-09T20:28:16.985Z",
      "x_nadsec_last_seen": "2026-04-09T20:35:21.765Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "268552"
      ],
      "x_nadsec_orgs": [
        "NETSBRASIL LTDA"
      ]
    },
    {
      "created": "2026-04-09T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--1f10fe11-4c00-4f2f-a94a-62fbed7ccc2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.227.24.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T21:05:05.000Z",
      "valid_until": "2026-05-11T21:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T20:54:13.675Z",
      "x_nadsec_last_seen": "2026-04-09T20:54:13.675Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-09T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=12683; asn_org=Rostelecom",
      "id": "indicator--9bb9b8c8-c472-401c-9fee-87723ecc2900",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '77.39.109.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T21:05:05.000Z",
      "valid_until": "2026-05-11T21:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-09T21:01:25.920Z",
      "x_nadsec_last_seen": "2026-04-09T21:08:17.702Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12683"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-09T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--1418240a-e351-434e-8c89-29a37c03ff41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '180.244.49.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T22:05:05.000Z",
      "valid_until": "2026-05-11T22:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-09T21:55:12.231Z",
      "x_nadsec_last_seen": "2026-04-09T21:55:12.275Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-09T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mqttd; ports=1883; cc=FR; asn=211590; asn_org=Bucklog SARL",
      "id": "indicator--2cb1f561-b0ad-4136-8b61-8fc0d84861f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.177.72.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T22:05:05.000Z",
      "valid_until": "2026-05-11T22:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-09T21:17:05.223Z",
      "x_nadsec_last_seen": "2026-04-09T21:17:06.426Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "211590"
      ],
      "x_nadsec_orgs": [
        "Bucklog SARL"
      ]
    },
    {
      "created": "2026-04-09T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=24835; asn_org=RAYA Telecom - Egypt",
      "id": "indicator--8df053fa-352c-4913-bdd9-b04c4862fad5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.221.164.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T22:05:05.000Z",
      "valid_until": "2026-05-11T22:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T21:08:23.333Z",
      "x_nadsec_last_seen": "2026-04-09T21:08:23.333Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24835"
      ],
      "x_nadsec_orgs": [
        "RAYA Telecom - Egypt"
      ]
    },
    {
      "created": "2026-04-09T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--3642bddd-cecd-4a4b-9060-4963481d8aea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '52.186.182.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T22:05:05.000Z",
      "valid_until": "2026-05-11T22:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-09T21:25:22.685Z",
      "x_nadsec_last_seen": "2026-04-09T21:25:23.489Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-09T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--ca2ab586-c585-4e74-81b6-3519c2964731",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T22:05:05.000Z",
      "valid_until": "2026-05-11T22:05:03.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-09T21:33:57.306Z",
      "x_nadsec_last_seen": "2026-04-21T12:00:58.104Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-09T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=33892; asn_org=LLC Severskelectrosvyaz",
      "id": "indicator--8d297765-eb7c-4622-9606-7ebdf7d415ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '78.136.217.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T22:05:05.000Z",
      "valid_until": "2026-05-11T22:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T21:36:42.927Z",
      "x_nadsec_last_seen": "2026-04-09T21:38:50.178Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "33892"
      ],
      "x_nadsec_orgs": [
        "LLC Severskelectrosvyaz"
      ]
    },
    {
      "created": "2026-04-09T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--672d5831-c75d-4fe5-9d8f-a0c3626f6f9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '8.216.2.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T22:05:05.000Z",
      "valid_until": "2026-05-11T22:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T21:29:04.158Z",
      "x_nadsec_last_seen": "2026-04-09T21:29:04.158Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-09T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=30936; asn_org=RENET COM Ltd.",
      "id": "indicator--1ce10881-54ed-4753-99ec-f281886c41a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '82.116.45.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T22:05:05.000Z",
      "valid_until": "2026-05-11T22:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-09T21:30:02.990Z",
      "x_nadsec_last_seen": "2026-04-09T21:32:07.917Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "30936"
      ],
      "x_nadsec_orgs": [
        "RENET COM Ltd."
      ]
    },
    {
      "created": "2026-04-09T23:05:34.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=DE; asn=213438; asn_org=ColocaTel Inc.",
      "id": "indicator--eab6f0d3-d241-42cc-8cb6-7d0f753c4725",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T23:05:34.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '193.142.146.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T23:05:34.000Z",
      "valid_until": "2026-05-11T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T22:43:19.454Z",
      "x_nadsec_last_seen": "2026-04-09T22:43:19.454Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "213438"
      ],
      "x_nadsec_orgs": [
        "ColocaTel Inc."
      ]
    },
    {
      "created": "2026-04-09T23:05:34.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--46fec1e9-14b4-4feb-ae86-b315a445e813",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T23:05:34.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.106.57.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T23:05:34.000Z",
      "valid_until": "2026-05-11T23:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-09T22:07:44.552Z",
      "x_nadsec_last_seen": "2026-04-09T22:07:54.725Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-09T23:05:34.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--c3dd1678-86b1-4216-b1cd-4d3f61b9c6b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T23:05:34.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.140.119.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T23:05:34.000Z",
      "valid_until": "2026-05-11T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T22:45:26.124Z",
      "x_nadsec_last_seen": "2026-04-10T09:40:40.140Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-04-09T23:05:34.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--b893af61-73ff-4657-b74d-c8205a2d167e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T23:05:34.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.241.166.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T23:05:34.000Z",
      "valid_until": "2026-05-11T23:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-09T22:23:24.202Z",
      "x_nadsec_last_seen": "2026-04-28T15:18:43.129Z",
      "x_nadsec_ports": [
        "21",
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s",
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@",
        ""
      ]
    },
    {
      "created": "2026-04-09T23:05:34.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KE; asn=30844; asn_org=Liquid Telecommunications Ltd",
      "id": "indicator--5c6426f0-3519-48be-9859-db09d59c10c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T23:05:34.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.72.207.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T23:05:34.000Z",
      "valid_until": "2026-05-11T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T22:39:49.809Z",
      "x_nadsec_last_seen": "2026-04-09T22:41:57.375Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "30844"
      ],
      "x_nadsec_orgs": [
        "Liquid Telecommunications Ltd"
      ]
    },
    {
      "created": "2026-04-09T23:05:34.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--31a722bf-15ad-4025-9e85-c9b1b9e13028",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T23:05:34.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '61.5.150.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T23:05:34.000Z",
      "valid_until": "2026-05-11T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T22:36:20.883Z",
      "x_nadsec_last_seen": "2026-04-09T22:36:20.883Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ]
    },
    {
      "created": "2026-04-09T23:05:34.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--7219aad9-dbc3-4ce3-8388-561beee46175",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T23:05:34.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T23:05:34.000Z",
      "valid_until": "2026-05-11T23:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-09T22:56:01.122Z",
      "x_nadsec_last_seen": "2026-04-26T13:32:03.667Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-09T23:05:34.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--9fa37e43-d99d-4d0a-96ca-67fc8b193db0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T23:05:34.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T23:05:34.000Z",
      "valid_until": "2026-05-11T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T22:39:15.434Z",
      "x_nadsec_last_seen": "2026-04-09T22:39:15.434Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-09T23:05:34.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--b0769509-bc7f-4571-a4fd-97b9ff84f686",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T23:05:34.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T23:05:34.000Z",
      "valid_until": "2026-05-11T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T22:15:16.159Z",
      "x_nadsec_last_seen": "2026-04-09T22:15:16.159Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-09T23:05:34.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--14fa0c6f-c5ba-4065-9828-16eb3d750103",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T23:05:34.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T23:05:34.000Z",
      "valid_until": "2026-05-11T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T22:15:26.375Z",
      "x_nadsec_last_seen": "2026-04-09T22:15:26.375Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-10T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MY; asn=9534; asn_org=Binariang Berhad",
      "id": "indicator--04983f96-61f0-4247-a426-0a7463c94e43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.211.215.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T00:05:11.000Z",
      "valid_until": "2026-05-12T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T23:16:22.091Z",
      "x_nadsec_last_seen": "2026-04-09T23:18:27.742Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "9534"
      ],
      "x_nadsec_orgs": [
        "Binariang Berhad"
      ]
    },
    {
      "created": "2026-04-10T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--dd9d5c03-ba6c-4a39-85b0-11da3e7425a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.233.112.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T00:05:11.000Z",
      "valid_until": "2026-05-12T00:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-09T23:32:52.007Z",
      "x_nadsec_last_seen": "2026-04-24T12:23:10.171Z",
      "x_nadsec_ports": [
        "27017",
        "3306"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-10T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--5cf49f30-b480-4e30-ad7c-e3df116c9c65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T00:05:11.000Z",
      "valid_until": "2026-05-12T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-09T23:50:08.678Z",
      "x_nadsec_last_seen": "2026-04-09T23:50:08.678Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-10T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=RU; asn=39442; asn_org=JSC RDE Unico; user(top)=**",
      "id": "indicator--378bbf40-2daa-4961-8bd5-a5bae6f98684",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '217.149.188.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T00:05:11.000Z",
      "valid_until": "2026-05-12T00:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-09T23:49:01.501Z",
      "x_nadsec_last_seen": "2026-04-11T16:44:22.934Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "39442"
      ],
      "x_nadsec_orgs": [
        "JSC RDE Unico"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-10T01:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--4067d81f-3b7a-4edd-90c3-8e0e3928ad1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T01:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.69.63.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T01:05:14.000Z",
      "valid_until": "2026-05-12T01:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-10T00:59:58.054Z",
      "x_nadsec_last_seen": "2026-04-10T01:06:13.205Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-04-10T01:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--013694d9-6b42-4300-8a48-b5bcabd021c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T01:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.119.96.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T01:05:14.000Z",
      "valid_until": "2026-05-12T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-10T00:18:12.621Z",
      "x_nadsec_last_seen": "2026-04-10T00:18:22.795Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-10T01:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--8c89fb6d-42eb-4058-9756-b648344683ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T01:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.231.255.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T01:05:14.000Z",
      "valid_until": "2026-05-12T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-10T00:29:28.961Z",
      "x_nadsec_last_seen": "2026-04-10T00:31:33.770Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-10T01:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=VE; asn=27717; asn_org=Corporacion Digitel C.A.",
      "id": "indicator--85fdd918-b7da-4152-9cdf-16d8032d10fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T01:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.167.6.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T01:05:14.000Z",
      "valid_until": "2026-05-12T01:05:09.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-04-10T00:22:41.088Z",
      "x_nadsec_last_seen": "2026-04-10T00:24:37.640Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "27717"
      ],
      "x_nadsec_orgs": [
        "Corporacion Digitel C.A."
      ]
    },
    {
      "created": "2026-04-10T01:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--28967a33-889b-4056-866e-96f3f2d3e21c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T01:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.64.106.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T01:05:14.000Z",
      "valid_until": "2026-05-12T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-10T00:30:15.174Z",
      "x_nadsec_last_seen": "2026-04-10T00:30:15.530Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-10T01:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--733909ad-e7b8-4f1f-ba12-9c6426b45650",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T01:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '54.174.222.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T01:05:14.000Z",
      "valid_until": "2026-05-12T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T01:00:02.945Z",
      "x_nadsec_last_seen": "2026-04-10T01:00:02.945Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-10T01:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PK; asn=45595; asn_org=Pakistan Telecom Company Limited",
      "id": "indicator--85c4dffb-9aef-45de-890e-6043b7835bea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T01:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '58.181.99.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T01:05:14.000Z",
      "valid_until": "2026-05-12T01:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-10T00:48:58.115Z",
      "x_nadsec_last_seen": "2026-04-10T00:55:50.767Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "45595"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecom Company Limited"
      ]
    },
    {
      "created": "2026-04-10T01:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=209059; asn_org=G COM Ltd.",
      "id": "indicator--12e87400-30ac-4984-81cf-df2f66913043",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T01:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '93.177.126.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T01:05:14.000Z",
      "valid_until": "2026-05-12T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-10T00:49:13.998Z",
      "x_nadsec_last_seen": "2026-04-10T00:51:20.100Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "209059"
      ],
      "x_nadsec_orgs": [
        "G COM Ltd."
      ]
    },
    {
      "created": "2026-04-10T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=23; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--66a0241d-a5b4-4e98-a4be-65fe77eff654",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '111.75.54.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T02:05:11.000Z",
      "valid_until": "2026-05-12T02:05:08.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-04-10T02:03:14.983Z",
      "x_nadsec_last_seen": "2026-04-10T02:05:35.679Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-10T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--1b361286-6ade-4d62-b77d-7e4b6562983d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.224.197.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T02:05:11.000Z",
      "valid_until": "2026-05-12T02:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-10T01:07:59.217Z",
      "x_nadsec_last_seen": "2026-04-13T15:42:57.001Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-10T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--e6c9c779-4e88-45cf-a04c-54b28bb33bcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '171.5.133.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T02:05:11.000Z",
      "valid_until": "2026-05-12T02:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-10T01:32:40.615Z",
      "x_nadsec_last_seen": "2026-04-10T01:34:45.113Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-04-10T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=LT; asn=209605; asn_org=UAB Host Baltic",
      "id": "indicator--fdfc767d-3012-402a-84b1-f55acece7c35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.36.81.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T02:05:11.000Z",
      "valid_until": "2026-05-12T02:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-10T02:04:35.598Z",
      "x_nadsec_last_seen": "2026-04-27T23:16:15.652Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LT"
      ],
      "x_nadsec_asns": [
        "209605"
      ],
      "x_nadsec_orgs": [
        "UAB Host Baltic"
      ]
    },
    {
      "created": "2026-04-10T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--229fa771-3561-4a11-99a2-76352af19254",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T02:05:11.000Z",
      "valid_until": "2026-05-12T02:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-10T01:35:12.281Z",
      "x_nadsec_last_seen": "2026-04-19T23:32:56.733Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-10T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BG; asn=213438; asn_org=ColocaTel Inc.",
      "id": "indicator--c36157c2-48c0-4d2a-9f56-141871b0d8e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.124.8.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T02:05:11.000Z",
      "valid_until": "2026-05-12T02:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T01:26:06.595Z",
      "x_nadsec_last_seen": "2026-04-10T01:26:06.595Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "213438"
      ],
      "x_nadsec_orgs": [
        "ColocaTel Inc."
      ]
    },
    {
      "created": "2026-04-10T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=CN; asn=134810; asn_org=China Mobile Group JiLin communications corporation",
      "id": "indicator--e5745c75-6954-4b63-acf9-7992f894f8e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '111.26.77.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T03:05:10.000Z",
      "valid_until": "2026-05-12T03:05:08.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-04-10T02:57:17.204Z",
      "x_nadsec_last_seen": "2026-04-10T02:58:18.652Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "134810"
      ],
      "x_nadsec_orgs": [
        "China Mobile Group JiLin communications corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "!******x"
      ]
    },
    {
      "created": "2026-04-10T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--e78b748f-a5e9-42da-a112-2872911859f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.70.131.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T03:05:10.000Z",
      "valid_until": "2026-05-12T03:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-10T02:41:44.710Z",
      "x_nadsec_last_seen": "2026-04-10T02:48:32.815Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-04-10T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--093b53e7-34df-4b65-9819-183503b0e970",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '123.173.91.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T03:05:10.000Z",
      "valid_until": "2026-05-12T03:05:08.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-04-10T02:50:44.616Z",
      "x_nadsec_last_seen": "2026-04-10T04:33:24.346Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "!***%"
      ]
    },
    {
      "created": "2026-04-10T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--1031693e-2b25-4af7-a19d-7dbbbd794d83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.182.240.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T04:05:11.000Z",
      "valid_until": "2026-05-12T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-10T03:14:57.020Z",
      "x_nadsec_last_seen": "2026-04-10T03:17:01.317Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-04-10T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=56044; asn_org=China Mobile communications corporation",
      "id": "indicator--0ced2db5-626a-4bf8-b158-7f28da62f510",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '112.39.146.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T04:05:11.000Z",
      "valid_until": "2026-05-12T04:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-10T03:52:52.002Z",
      "x_nadsec_last_seen": "2026-04-10T03:59:27.963Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56044"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-04-10T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--ae80bf14-098e-478f-8a2c-5305e0631cb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T04:05:11.000Z",
      "valid_until": "2026-05-12T04:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-10T03:53:32.610Z",
      "x_nadsec_last_seen": "2026-04-17T03:57:57.787Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-10T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=268552; asn_org=NETSBRASIL LTDA",
      "id": "indicator--600be6a4-4c0c-4213-a532-8494abc4c099",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.163.106.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T04:05:11.000Z",
      "valid_until": "2026-05-12T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-10T03:19:56.893Z",
      "x_nadsec_last_seen": "2026-04-11T07:22:46.853Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "268552"
      ],
      "x_nadsec_orgs": [
        "NETSBRASIL LTDA"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-10T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=65; services=mysqld; ports=3306; cc=CN; asn=4134; asn_org=Chinanet; user(top)=r**t",
      "id": "indicator--420350ba-21b9-4aa3-916c-9cbf367d0aba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '180.97.218.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T05:05:10.000Z",
      "valid_until": "2026-05-12T05:05:08.000Z",
      "x_nadsec_event_count": 89,
      "x_nadsec_first_seen": "2026-04-10T04:40:39.407Z",
      "x_nadsec_last_seen": "2026-04-11T16:18:26.451Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-10T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--fbe7af04-7de7-41ab-9a3c-78898d66541e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.176.184.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T05:05:10.000Z",
      "valid_until": "2026-05-12T05:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-10T04:58:32.605Z",
      "x_nadsec_last_seen": "2026-04-10T05:05:04.949Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-04-10T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; user(top)=**; pass(top)=1*******9",
      "id": "indicator--026975f7-d041-404f-b23e-4c8951aaa0d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '183.220.52.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T05:05:10.000Z",
      "valid_until": "2026-05-12T05:05:08.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-04-10T04:55:31.824Z",
      "x_nadsec_last_seen": "2026-04-10T04:55:37.507Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1*******9"
      ]
    },
    {
      "created": "2026-04-10T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d83d6fc8-74c6-48f8-9dd1-dcb08b1b5408",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.150.195.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T05:05:10.000Z",
      "valid_until": "2026-05-12T05:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-10T05:02:35.712Z",
      "x_nadsec_last_seen": "2026-04-10T05:02:45.888Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-10T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--93fa5cdb-42be-4446-b28e-a4b328843225",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.169.106.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T05:05:10.000Z",
      "valid_until": "2026-05-12T05:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T04:15:42.889Z",
      "x_nadsec_last_seen": "2026-04-10T04:15:42.889Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-10T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--15f7096f-5a39-41fe-bc25-12d66ff3f150",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.80.88.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T05:05:10.000Z",
      "valid_until": "2026-05-12T05:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-10T04:43:45.528Z",
      "x_nadsec_last_seen": "2026-04-10T04:43:55.879Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-10T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--36aff66c-644e-4830-b407-284f9e017b78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T05:05:10.000Z",
      "valid_until": "2026-05-12T05:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-10T04:22:32.337Z",
      "x_nadsec_last_seen": "2026-04-30T00:02:44.867Z",
      "x_nadsec_ports": [
        "21",
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-10T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--4ea05228-b316-4d56-a5d0-cffdabc7438c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T05:05:10.000Z",
      "valid_until": "2026-05-12T05:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-10T04:14:51.410Z",
      "x_nadsec_last_seen": "2026-04-26T15:17:28.823Z",
      "x_nadsec_ports": [
        "3306",
        "81",
        "135",
        "1723"
      ],
      "x_nadsec_services": [
        "mysqld",
        "epmapper",
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-10T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--c1e3a8f7-5f48-4f68-9fcb-3b139e65e5bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T05:05:10.000Z",
      "valid_until": "2026-05-12T05:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T04:32:26.604Z",
      "x_nadsec_last_seen": "2026-04-10T04:32:26.604Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-10T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--a7bd9725-e481-43b1-ab3d-db6e21486ac1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T05:05:10.000Z",
      "valid_until": "2026-05-12T05:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T04:32:26.838Z",
      "x_nadsec_last_seen": "2026-04-10T04:32:26.838Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-10T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--79d4cc36-3e9f-41e8-9a0f-2c94aba48e48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T06:05:11.000Z",
      "valid_until": "2026-05-12T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-10T05:31:24.767Z",
      "x_nadsec_last_seen": "2026-04-10T05:31:25.612Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-10T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=FR; asn=51167; asn_org=Contabo GmbH",
      "id": "indicator--5f191fe3-6156-45c5-a394-acbc2c1b3c86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '161.97.99.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T06:05:11.000Z",
      "valid_until": "2026-05-12T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-10T05:35:28.604Z",
      "x_nadsec_last_seen": "2026-04-10T05:35:29.137Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "51167"
      ],
      "x_nadsec_orgs": [
        "Contabo GmbH"
      ]
    },
    {
      "created": "2026-04-10T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4c5f893e-6e77-4d3d-a772-ef8dccccb160",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.118.32.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T06:05:11.000Z",
      "valid_until": "2026-05-12T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T05:44:32.192Z",
      "x_nadsec_last_seen": "2026-04-10T05:44:32.192Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-10T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=NL; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--a2f6cc02-b477-4aaa-91c0-5318a669db37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '80.82.77.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T06:05:11.000Z",
      "valid_until": "2026-05-12T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-10T05:28:06.020Z",
      "x_nadsec_last_seen": "2026-04-22T03:59:22.130Z",
      "x_nadsec_ports": [
        "81",
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-04-10T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133275; asn_org=Gigantic Infotel Pvt Ltd",
      "id": "indicator--e363f7a4-7cf4-4f04-91d1-528888657f84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.193.198.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T07:05:10.000Z",
      "valid_until": "2026-05-12T07:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-10T06:35:49.273Z",
      "x_nadsec_last_seen": "2026-04-10T06:37:54.198Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133275"
      ],
      "x_nadsec_orgs": [
        "Gigantic Infotel Pvt Ltd"
      ]
    },
    {
      "created": "2026-04-10T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=59165; asn_org=Auspice Infratel Pvt. Ltd.",
      "id": "indicator--ea551429-a4e4-47c8-b9c6-d07f6a387730",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.83.254.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T07:05:10.000Z",
      "valid_until": "2026-05-12T07:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-10T06:36:49.944Z",
      "x_nadsec_last_seen": "2026-04-25T07:11:59.675Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "59165"
      ],
      "x_nadsec_orgs": [
        "Auspice Infratel Pvt. Ltd."
      ]
    },
    {
      "created": "2026-04-10T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4ee71029-9f7e-4fe9-887b-5eda62c67d8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T07:05:10.000Z",
      "valid_until": "2026-05-12T07:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-10T06:26:32.924Z",
      "x_nadsec_last_seen": "2026-04-18T08:47:34.678Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-10T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--fb722800-be29-4687-b8f9-2653af4098fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.250.175.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T07:05:10.000Z",
      "valid_until": "2026-05-12T07:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-10T06:43:35.642Z",
      "x_nadsec_last_seen": "2026-04-10T06:43:59.223Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-10T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--a7130a77-96de-4597-be13-d6fb8e19d66d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '101.36.127.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T08:05:11.000Z",
      "valid_until": "2026-05-12T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T07:33:44.327Z",
      "x_nadsec_last_seen": "2026-04-10T07:33:44.327Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-10T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=DE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--b1c97356-bbe4-444e-af6f-0a5433e64b49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.193.59.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T08:05:11.000Z",
      "valid_until": "2026-05-12T08:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-10T07:32:32.289Z",
      "x_nadsec_last_seen": "2026-04-10T07:33:18.190Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-10T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=NG; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--2a07d7c3-5edb-4573-95c8-64f2d45786c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.11.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T08:05:11.000Z",
      "valid_until": "2026-05-12T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-10T07:43:58.756Z",
      "x_nadsec_last_seen": "2026-04-10T07:44:19.406Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-10T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--47816877-ab8b-47d3-beea-341c09772672",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.202.49.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T08:05:11.000Z",
      "valid_until": "2026-05-12T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T07:26:18.794Z",
      "x_nadsec_last_seen": "2026-04-10T07:26:18.794Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-10T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--1d8e0c31-707f-4df2-bdfa-7208a7efd5b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T08:05:11.000Z",
      "valid_until": "2026-05-12T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T07:13:03.390Z",
      "x_nadsec_last_seen": "2026-04-10T07:13:03.390Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-10T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--98fecba9-2469-439f-98ca-dd804f89269d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T08:05:11.000Z",
      "valid_until": "2026-05-12T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-10T07:48:22.225Z",
      "x_nadsec_last_seen": "2026-04-19T07:31:22.508Z",
      "x_nadsec_ports": [
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-10T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--c76aeb91-3961-4e5b-81ec-62f9b24bb0e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T08:05:11.000Z",
      "valid_until": "2026-05-12T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T07:48:08.526Z",
      "x_nadsec_last_seen": "2026-04-10T07:48:08.526Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-10T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--4e17ce7d-936b-4176-97f8-31cffa4d722e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '89.250.166.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T08:05:11.000Z",
      "valid_until": "2026-05-12T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-10T07:48:34.800Z",
      "x_nadsec_last_seen": "2026-04-10T07:58:58.232Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-10T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--890cab7f-50b3-4ff8-801c-628773870de8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T08:05:11.000Z",
      "valid_until": "2026-05-12T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T08:02:22.791Z",
      "x_nadsec_last_seen": "2026-04-10T08:02:22.791Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-10T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3a792725-7abb-4277-9de2-73fd60087549",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T08:05:11.000Z",
      "valid_until": "2026-05-12T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T08:01:51.538Z",
      "x_nadsec_last_seen": "2026-04-10T08:01:51.538Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-10T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--347f7b08-e064-472a-98a3-3e9d8f52184b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T08:05:11.000Z",
      "valid_until": "2026-05-12T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T08:02:33.141Z",
      "x_nadsec_last_seen": "2026-04-10T08:02:33.141Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-10T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--ce6d399a-1cbb-4ad6-bc7e-cee7b5ced971",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T08:05:11.000Z",
      "valid_until": "2026-05-12T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T08:01:51.232Z",
      "x_nadsec_last_seen": "2026-04-10T08:01:51.232Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-10T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=324; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--ee691412-9e13-4085-b637-2cd73b9855e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.160.170.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T09:05:10.000Z",
      "valid_until": "2026-05-12T09:05:08.000Z",
      "x_nadsec_event_count": 3029,
      "x_nadsec_first_seen": "2026-04-10T08:26:34.097Z",
      "x_nadsec_last_seen": "2026-04-10T14:02:36.077Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-10T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--64f25e71-167c-428d-bbba-698da199ecd3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '119.155.46.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T09:05:10.000Z",
      "valid_until": "2026-05-12T09:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-10T08:56:08.056Z",
      "x_nadsec_last_seen": "2026-04-10T09:02:58.963Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-04-10T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--d72a6e65-eb82-4f63-a342-4b4b695f1d6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.211.0.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T09:05:10.000Z",
      "valid_until": "2026-05-12T09:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-10T08:39:23.687Z",
      "x_nadsec_last_seen": "2026-04-10T08:43:34.261Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-10T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KE; asn=37061; asn_org=Safaricom",
      "id": "indicator--d4760efa-c1ff-4fae-beac-794bd982a261",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.248.174.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T09:05:10.000Z",
      "valid_until": "2026-05-12T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-10T08:16:44.094Z",
      "x_nadsec_last_seen": "2026-04-10T08:18:51.309Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "37061"
      ],
      "x_nadsec_orgs": [
        "Safaricom"
      ]
    },
    {
      "created": "2026-04-10T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--d1b159c7-ab87-497a-8fae-f236cc469bb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T09:05:10.000Z",
      "valid_until": "2026-05-12T09:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T08:49:37.090Z",
      "x_nadsec_last_seen": "2026-04-10T08:49:37.090Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-10T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c63ac833-6f36-42de-b4e2-e92a2c70b3a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.201.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T09:05:10.000Z",
      "valid_until": "2026-05-12T09:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-10T08:53:28.706Z",
      "x_nadsec_last_seen": "2026-04-10T08:53:38.866Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-10T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=KH; asn=38600; asn_org=SMART AXIATA Co., Ltd.; user(top)=**",
      "id": "indicator--697cce24-05ba-4e07-aa81-4993024d0623",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '202.56.3.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T09:05:10.000Z",
      "valid_until": "2026-05-12T09:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T08:05:11.132Z",
      "x_nadsec_last_seen": "2026-04-10T08:05:11.132Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "KH"
      ],
      "x_nadsec_asns": [
        "38600"
      ],
      "x_nadsec_orgs": [
        "SMART AXIATA Co., Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-10T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=LV; asn=24921; asn_org=Latvijas Mobilais Telefons SIA",
      "id": "indicator--ce668c94-c016-4ace-8280-67d4f15684e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '212.3.194.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T09:05:10.000Z",
      "valid_until": "2026-05-12T09:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T08:35:33.879Z",
      "x_nadsec_last_seen": "2026-04-10T08:35:33.879Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LV"
      ],
      "x_nadsec_asns": [
        "24921"
      ],
      "x_nadsec_orgs": [
        "Latvijas Mobilais Telefons SIA"
      ]
    },
    {
      "created": "2026-04-10T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--45eb9958-29f0-4cd5-9885-ee201f49a9a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '218.1.116.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T09:05:10.000Z",
      "valid_until": "2026-05-12T09:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T08:24:41.312Z",
      "x_nadsec_last_seen": "2026-04-10T08:24:41.312Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-04-10T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--0a3fdcc5-3e55-4e8f-95de-8c04148b3a3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '61.247.230.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T09:05:10.000Z",
      "valid_until": "2026-05-12T09:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-10T09:01:31.599Z",
      "x_nadsec_last_seen": "2026-04-10T09:01:31.650Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-04-10T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company; user(top)=**",
      "id": "indicator--a68c3be4-b721-4564-a7aa-e48aeaf78ab9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '122.54.146.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T10:05:10.000Z",
      "valid_until": "2026-05-12T10:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T09:09:31.879Z",
      "x_nadsec_last_seen": "2026-04-10T09:09:31.879Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-10T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CA; asn=215540; asn_org=Global Connectivity Solutions Llp",
      "id": "indicator--c3d5a5b3-d121-4b97-a4b1-add8e52b586d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.45.177.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T10:05:10.000Z",
      "valid_until": "2026-05-12T10:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-10T09:08:02.417Z",
      "x_nadsec_last_seen": "2026-04-28T13:42:08.658Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "215540"
      ],
      "x_nadsec_orgs": [
        "Global Connectivity Solutions Llp"
      ]
    },
    {
      "created": "2026-04-10T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation; user(top)=**",
      "id": "indicator--4c312572-2a16-405d-af3b-35b6b6813037",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.119.43.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T10:05:10.000Z",
      "valid_until": "2026-05-12T10:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T09:39:19.711Z",
      "x_nadsec_last_seen": "2026-04-10T09:39:19.711Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-10T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c1ecdc01-23c3-4730-82fa-0d49feca56c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T10:05:10.000Z",
      "valid_until": "2026-05-12T10:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-10T09:27:01.467Z",
      "x_nadsec_last_seen": "2026-04-10T09:27:02.110Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-10T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--0f9d045e-acd5-4809-952e-11d669329666",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.245.132.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T10:05:10.000Z",
      "valid_until": "2026-05-12T10:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T09:49:15.301Z",
      "x_nadsec_last_seen": "2026-04-10T09:49:15.301Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-10T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--2da53215-990c-4ca6-9acd-94a2ad385114",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T10:05:10.000Z",
      "valid_until": "2026-05-12T10:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-10T09:51:49.999Z",
      "x_nadsec_last_seen": "2026-04-12T16:36:52.749Z",
      "x_nadsec_ports": [
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-10T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--406ccc66-5572-420f-a0e5-ef28ff6ca8a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T10:05:10.000Z",
      "valid_until": "2026-05-12T10:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T09:10:00.966Z",
      "x_nadsec_last_seen": "2026-04-10T09:10:00.966Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-10T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--f24bce49-2670-4df4-bdc2-46f51c864415",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.85.218.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:05:10.000Z",
      "valid_until": "2026-05-12T11:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T10:17:38.833Z",
      "x_nadsec_last_seen": "2026-04-10T10:17:38.833Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-10T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--19a16caa-ad22-4cf9-943a-81165d8e6062",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '101.70.109.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:05:10.000Z",
      "valid_until": "2026-05-12T11:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T10:17:30.233Z",
      "x_nadsec_last_seen": "2026-04-10T10:17:30.233Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-04-10T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--6dc88074-e2b8-43df-9942-128cf61127a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '171.105.76.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:05:10.000Z",
      "valid_until": "2026-05-12T11:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T10:17:13.432Z",
      "x_nadsec_last_seen": "2026-04-10T10:17:13.432Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-10T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=JO; asn=48832; asn_org=Jordanian mobile phone services Ltd",
      "id": "indicator--4de558f7-78f7-47c1-a7d0-04792884d862",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '188.247.94.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:05:10.000Z",
      "valid_until": "2026-05-12T11:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-10T11:00:59.857Z",
      "x_nadsec_last_seen": "2026-04-10T11:08:06.749Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "48832"
      ],
      "x_nadsec_orgs": [
        "Jordanian mobile phone services Ltd"
      ]
    },
    {
      "created": "2026-04-10T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--7c1aed59-cb99-44d8-b4db-eb52b7ea79ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.221.58.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:05:10.000Z",
      "valid_until": "2026-05-12T11:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-10T10:55:36.918Z",
      "x_nadsec_last_seen": "2026-04-10T10:55:37.267Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-10T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--e223d88f-8f85-4520-a916-46a3ac38bab1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '220.250.11.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:05:10.000Z",
      "valid_until": "2026-05-12T11:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T10:17:23.750Z",
      "x_nadsec_last_seen": "2026-04-10T10:17:23.750Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-04-10T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--dbb143a2-341e-4012-8d48-95ec542edacc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.153.73.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:05:11.000Z",
      "valid_until": "2026-05-12T12:05:09.000Z",
      "x_nadsec_event_count": 3108,
      "x_nadsec_first_seen": "2026-04-10T11:52:53.034Z",
      "x_nadsec_last_seen": "2026-04-10T16:02:52.777Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-10T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=23966; asn_org=LINKdotNET Telecom Limited",
      "id": "indicator--6030dd0e-b1f4-4972-a141-bbc10d3a5f58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '210.2.130.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:05:11.000Z",
      "valid_until": "2026-05-12T12:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-10T11:18:06.840Z",
      "x_nadsec_last_seen": "2026-04-10T11:18:06.885Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23966"
      ],
      "x_nadsec_orgs": [
        "LINKdotNET Telecom Limited"
      ]
    },
    {
      "created": "2026-04-10T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia; user(top)=**",
      "id": "indicator--aceb49bf-c37e-4065-b6a6-02edc922215a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.75.236.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:05:11.000Z",
      "valid_until": "2026-05-12T12:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-10T11:32:52.629Z",
      "x_nadsec_last_seen": "2026-04-10T11:32:53.228Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-10T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--c0775695-4517-4859-85d4-16b11ab37288",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:05:11.000Z",
      "valid_until": "2026-05-12T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T11:20:06.984Z",
      "x_nadsec_last_seen": "2026-04-10T11:20:06.984Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-10T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=215925; asn_org=Vpsvault.host Ltd",
      "id": "indicator--e2d23c18-f4b2-4a4a-be95-83359bb6ed81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.121.84.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:05:11.000Z",
      "valid_until": "2026-05-12T12:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-10T11:37:09.400Z",
      "x_nadsec_last_seen": "2026-04-11T11:56:28.994Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "215925"
      ],
      "x_nadsec_orgs": [
        "Vpsvault.host Ltd"
      ]
    },
    {
      "created": "2026-04-10T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=43714; asn_org=Production co-operative Economic-legal laboratory",
      "id": "indicator--6c80be06-ac0f-4eb5-a012-b5b8b66de133",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '95.154.146.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:05:11.000Z",
      "valid_until": "2026-05-12T12:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-10T11:13:42.516Z",
      "x_nadsec_last_seen": "2026-04-10T11:21:12.097Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "43714"
      ],
      "x_nadsec_orgs": [
        "Production co-operative Economic-legal laboratory"
      ]
    },
    {
      "created": "2026-04-10T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--52fe56b4-1f4e-4aec-b4d7-bd090c4ffd24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '98.89.204.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:05:11.000Z",
      "valid_until": "2026-05-12T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T11:28:37.031Z",
      "x_nadsec_last_seen": "2026-04-10T11:28:37.031Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-10T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--dfedb572-ebdf-4da5-856e-8808b94c6125",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.93.151.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:05:10.000Z",
      "valid_until": "2026-05-12T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T12:29:32.190Z",
      "x_nadsec_last_seen": "2026-04-10T12:29:32.190Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-10T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=15; services=epmapper; ports=135; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--64dffaf1-4a1a-4c00-be3e-b835d0f95302",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.128.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:05:10.000Z",
      "valid_until": "2026-05-12T13:05:09.000Z",
      "x_nadsec_event_count": 29,
      "x_nadsec_first_seen": "2026-04-10T12:10:26.928Z",
      "x_nadsec_last_seen": "2026-04-24T02:51:30.929Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-10T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=25227; asn_org=JSC Avantel",
      "id": "indicator--a7f819c4-f2b3-4097-82c2-d9b73e0fbe79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '62.213.115.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:05:10.000Z",
      "valid_until": "2026-05-12T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T13:04:41.781Z",
      "x_nadsec_last_seen": "2026-04-10T13:04:41.781Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25227"
      ],
      "x_nadsec_orgs": [
        "JSC Avantel"
      ]
    },
    {
      "created": "2026-04-10T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--d78b36ef-0375-4f30-94c0-d6b82d59e4c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:05:10.000Z",
      "valid_until": "2026-05-12T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T12:36:35.208Z",
      "x_nadsec_last_seen": "2026-04-10T12:36:35.208Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-10T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CA; asn=215540; asn_org=Global Connectivity Solutions Llp",
      "id": "indicator--fcf19aec-8003-43f4-8cbc-c653c6f72dff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.45.177.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:05:10.000Z",
      "valid_until": "2026-05-12T14:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-10T13:47:07.672Z",
      "x_nadsec_last_seen": "2026-04-28T17:59:24.634Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "215540"
      ],
      "x_nadsec_orgs": [
        "Global Connectivity Solutions Llp"
      ]
    },
    {
      "created": "2026-04-10T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=18881; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--262afe6f-08e0-4198-b156-f99b3a80c83b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.212.58.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:05:10.000Z",
      "valid_until": "2026-05-12T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-10T13:58:12.880Z",
      "x_nadsec_last_seen": "2026-04-10T14:00:20.233Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "18881"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-04-10T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**",
      "id": "indicator--a6957b5c-148c-442f-84fb-380fa83a2d69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '49.82.210.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:05:10.000Z",
      "valid_until": "2026-05-12T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-10T13:07:56.178Z",
      "x_nadsec_last_seen": "2026-04-10T13:07:57.681Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-10T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=NL; asn=206264; asn_org=Amarutu Technology Ltd",
      "id": "indicator--c24038ec-dc60-4c29-851f-8887edf9bc8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.187.35.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:05:10.000Z",
      "valid_until": "2026-05-12T14:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-01T06:05:17.843Z",
      "x_nadsec_last_seen": "2026-04-25T19:22:11.595Z",
      "x_nadsec_ports": [
        "81",
        "21",
        "42",
        "45645"
      ],
      "x_nadsec_services": [
        "httpd",
        "ftpd",
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "206264"
      ],
      "x_nadsec_orgs": [
        "Amarutu Technology Ltd"
      ]
    },
    {
      "created": "2026-04-10T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--8bae08a2-790b-4d37-a2f4-f833e3ef3fb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:05:10.000Z",
      "valid_until": "2026-05-12T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T13:28:49.932Z",
      "x_nadsec_last_seen": "2026-04-10T13:28:49.932Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-10T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--5b4521e6-5ad5-4c56-820a-d8990d9c348e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:05:10.000Z",
      "valid_until": "2026-05-12T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T13:34:32.826Z",
      "x_nadsec_last_seen": "2026-04-10T13:34:32.826Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-10T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--889d01bc-c7a5-4179-be83-7022715816be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T15:05:10.000Z",
      "valid_until": "2026-05-12T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T14:54:07.615Z",
      "x_nadsec_last_seen": "2026-04-10T14:54:07.615Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-10T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--9b89c09d-5cf6-403e-bcd6-3f41628f1121",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T15:05:10.000Z",
      "valid_until": "2026-05-12T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-10T14:58:35.063Z",
      "x_nadsec_last_seen": "2026-04-30T05:02:34.908Z",
      "x_nadsec_ports": [
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-10T16:06:38.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--0e4fe60f-6d3a-4b89-9a12-02b974df2e2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T16:06:38.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '116.31.232.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:06:38.000Z",
      "valid_until": "2026-05-12T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-10T15:44:05.367Z",
      "x_nadsec_last_seen": "2026-04-10T15:44:29.935Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-10T16:06:38.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=46; services=smbd; ports=445; cc=PK; asn=131471; asn_org=Login.Me Pvt Ltd",
      "id": "indicator--afce727c-de26-4a24-8b94-8d1a2095da6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T16:06:38.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '119.30.85.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:06:38.000Z",
      "valid_until": "2026-05-12T16:05:09.000Z",
      "x_nadsec_event_count": 3154,
      "x_nadsec_first_seen": "2026-04-10T15:19:07.283Z",
      "x_nadsec_last_seen": "2026-04-10T18:33:09.019Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "131471"
      ],
      "x_nadsec_orgs": [
        "Login.Me Pvt Ltd"
      ]
    },
    {
      "created": "2026-04-10T16:06:38.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=23; services=smbd; ports=445; cc=IN; asn=55577; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--234ee13a-5c33-4977-a807-baee015df37b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T16:06:38.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '123.176.36.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:06:38.000Z",
      "valid_until": "2026-05-12T16:05:09.000Z",
      "x_nadsec_event_count": 2124,
      "x_nadsec_first_seen": "2026-04-10T16:03:54.127Z",
      "x_nadsec_last_seen": "2026-04-10T16:30:38.758Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55577"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-04-10T16:06:38.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b3fee87a-4dce-4c03-b7c7-a1e9e2a2253f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T16:06:38.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:06:38.000Z",
      "valid_until": "2026-05-12T16:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-10T15:48:56.564Z",
      "x_nadsec_last_seen": "2026-04-18T16:04:09.410Z",
      "x_nadsec_ports": [
        "1433",
        "27017"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-10T16:06:38.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--6cc620d9-4d79-4955-8b60-0e84516e1bd8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T16:06:38.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.38.201.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:06:38.000Z",
      "valid_until": "2026-05-12T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T15:57:45.169Z",
      "x_nadsec_last_seen": "2026-04-10T15:57:45.169Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-10T16:06:38.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--927668ca-97c1-4f68-9fd1-bd48a0c214f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T16:06:38.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.78.189.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:06:38.000Z",
      "valid_until": "2026-05-12T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-10T15:57:44.480Z",
      "x_nadsec_last_seen": "2026-04-27T12:35:20.443Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-10T16:06:38.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45117; asn_org=Ishans Network",
      "id": "indicator--dc19d76c-204e-4c0d-a6ce-029b238d31e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T16:06:38.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.255.227.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:06:38.000Z",
      "valid_until": "2026-05-12T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-10T15:28:08.109Z",
      "x_nadsec_last_seen": "2026-04-10T15:30:13.270Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45117"
      ],
      "x_nadsec_orgs": [
        "Ishans Network"
      ]
    },
    {
      "created": "2026-04-10T16:06:38.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--b7fa5d27-9bb2-443b-8a85-1777b2dd8e9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T16:06:38.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:06:38.000Z",
      "valid_until": "2026-05-12T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T15:07:13.794Z",
      "x_nadsec_last_seen": "2026-04-10T15:07:13.794Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-10T16:06:38.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--e299b081-f3ad-4150-a9a5-96d1cdbdf7db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T16:06:38.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:06:38.000Z",
      "valid_until": "2026-05-12T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-10T15:32:09.649Z",
      "x_nadsec_last_seen": "2026-04-10T21:55:52.436Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-10T16:06:38.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--ade4cd94-e8a4-40f0-8803-504cc4f3ae65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T16:06:38.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:06:38.000Z",
      "valid_until": "2026-05-12T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T15:31:00.010Z",
      "x_nadsec_last_seen": "2026-04-10T15:31:00.010Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-10T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--58a20621-13c9-4e20-8d26-57e66188491d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.90.97.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:05:10.000Z",
      "valid_until": "2026-05-12T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-10T16:56:57.446Z",
      "x_nadsec_last_seen": "2026-04-10T16:57:05.025Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-04-10T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=271244; asn_org=FORTINET TELECOMUNICACOES EIRELI; user(top)=**",
      "id": "indicator--77b9c6d1-125d-4912-96fc-8b9fe0f1aff5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '179.51.196.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:05:10.000Z",
      "valid_until": "2026-05-12T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T16:43:00.847Z",
      "x_nadsec_last_seen": "2026-04-10T16:43:00.847Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "271244"
      ],
      "x_nadsec_orgs": [
        "FORTINET TELECOMUNICACOES EIRELI"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-10T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8ac2642c-ed00-408c-9fd8-e4b55db4e8e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.169.81.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:05:10.000Z",
      "valid_until": "2026-05-12T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T16:42:36.237Z",
      "x_nadsec_last_seen": "2026-04-10T16:42:36.237Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-10T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=32475; asn_org=Internap Holding LLC",
      "id": "indicator--2303acee-2166-4ffb-9d86-d3741c8eb264",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '203.55.131.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:05:10.000Z",
      "valid_until": "2026-05-12T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-10T16:28:36.702Z",
      "x_nadsec_last_seen": "2026-04-16T04:57:44.365Z",
      "x_nadsec_ports": [
        "445",
        "1723"
      ],
      "x_nadsec_services": [
        "smbd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "32475"
      ],
      "x_nadsec_orgs": [
        "Internap Holding LLC"
      ]
    },
    {
      "created": "2026-04-10T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=32; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--5a159ee4-b440-4d5b-badc-928a608c485f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.183.107.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:05:10.000Z",
      "valid_until": "2026-05-12T17:05:09.000Z",
      "x_nadsec_event_count": 32,
      "x_nadsec_first_seen": "2026-04-10T16:33:39.357Z",
      "x_nadsec_last_seen": "2026-04-10T16:36:32.164Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-10T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--657609fb-0b78-4ec8-9cea-080b90eccb97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:05:10.000Z",
      "valid_until": "2026-05-12T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T16:58:55.790Z",
      "x_nadsec_last_seen": "2026-04-10T16:58:55.790Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-10T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--761576db-abd5-46b9-ab91-a594352149da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:05:10.000Z",
      "valid_until": "2026-05-12T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T16:58:56.094Z",
      "x_nadsec_last_seen": "2026-04-10T16:58:56.094Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-10T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--791e714e-eb8a-4df4-9267-890922c11ad1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '116.104.51.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:05:10.000Z",
      "valid_until": "2026-05-12T18:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-10T17:51:28.240Z",
      "x_nadsec_last_seen": "2026-04-14T16:19:36.683Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-10T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ea1a9b4e-e739-463e-8f90-c7af8c2fa606",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.237.125.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:05:10.000Z",
      "valid_until": "2026-05-12T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-10T17:16:49.740Z",
      "x_nadsec_last_seen": "2026-04-10T17:17:00.125Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-10T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=DO; asn=6400; asn_org=Compania Dominicana de Telefonos S. A.; user(top)=**",
      "id": "indicator--26c1b01b-fcba-4ecf-bf58-62cb41355536",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.167.20.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:05:10.000Z",
      "valid_until": "2026-05-12T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-10T17:34:49.222Z",
      "x_nadsec_last_seen": "2026-04-23T13:22:06.339Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "DO"
      ],
      "x_nadsec_asns": [
        "6400"
      ],
      "x_nadsec_orgs": [
        "Compania Dominicana de Telefonos S. A."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-10T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--071d8ad7-7da7-4ebd-8a9c-079ca8e5120a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:05:10.000Z",
      "valid_until": "2026-05-12T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T17:21:17.758Z",
      "x_nadsec_last_seen": "2026-04-10T17:21:17.758Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-10T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--7201b34b-d235-4c20-bb64-16c94298a0ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:05:10.000Z",
      "valid_until": "2026-05-12T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-10T17:37:32.357Z",
      "x_nadsec_last_seen": "2026-04-19T03:06:23.106Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-10T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=17538; asn_org=PT. Circlecom Nusantara Indonesia",
      "id": "indicator--aff01639-5fed-452c-88a2-0c15de03d5c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '202.165.40.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:05:10.000Z",
      "valid_until": "2026-05-12T18:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-10T18:03:12.401Z",
      "x_nadsec_last_seen": "2026-04-10T18:09:22.535Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17538"
      ],
      "x_nadsec_orgs": [
        "PT. Circlecom Nusantara Indonesia"
      ]
    },
    {
      "created": "2026-04-10T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AZ; asn=28787; asn_org=Aztelekom LLC",
      "id": "indicator--bf587661-569b-42e9-b965-63e3ed873d92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '213.154.0.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:05:10.000Z",
      "valid_until": "2026-05-12T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-10T17:14:08.668Z",
      "x_nadsec_last_seen": "2026-04-10T17:16:15.400Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "28787"
      ],
      "x_nadsec_orgs": [
        "Aztelekom LLC"
      ]
    },
    {
      "created": "2026-04-10T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--0aa8bbb4-23c8-4a2c-bb70-229b0a580f18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.76.59.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:05:10.000Z",
      "valid_until": "2026-05-12T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-10T17:55:41.648Z",
      "x_nadsec_last_seen": "2026-04-22T08:46:58.785Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-10T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CR; asn=28317; asn_org=NAVEGALO S.A.",
      "id": "indicator--4261061f-c9d7-43fb-8e1a-f1a579a1cb75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.121.141.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T20:05:10.000Z",
      "valid_until": "2026-05-12T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-10T19:38:13.278Z",
      "x_nadsec_last_seen": "2026-04-10T19:40:19.117Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CR"
      ],
      "x_nadsec_asns": [
        "28317"
      ],
      "x_nadsec_orgs": [
        "NAVEGALO S.A."
      ]
    },
    {
      "created": "2026-04-10T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--e60fed1c-4d2f-4798-bec5-d7aeb65423e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T20:05:10.000Z",
      "valid_until": "2026-05-12T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T19:15:56.724Z",
      "x_nadsec_last_seen": "2026-04-10T19:15:56.724Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-04-10T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--d5364081-3480-4139-9894-855b8073df55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T20:05:10.000Z",
      "valid_until": "2026-05-12T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T19:51:44.804Z",
      "x_nadsec_last_seen": "2026-04-10T19:51:44.804Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-10T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e882458e-b812-4802-bd3d-f847611050c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.98.166.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T20:05:10.000Z",
      "valid_until": "2026-05-12T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T19:25:12.584Z",
      "x_nadsec_last_seen": "2026-04-10T19:25:12.584Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-10T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=46; services=smbd; ports=445; cc=CN; asn=56041; asn_org=China Mobile communications corporation",
      "id": "indicator--7728432d-1627-4b37-a210-b178b25f1fd7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '223.94.86.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T20:05:10.000Z",
      "valid_until": "2026-05-12T20:05:09.000Z",
      "x_nadsec_event_count": 46,
      "x_nadsec_first_seen": "2026-04-10T19:14:37.771Z",
      "x_nadsec_last_seen": "2026-04-10T19:18:20.270Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56041"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-04-10T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=RU; asn=211860; asn_org=Nerushenko Vyacheslav Nikolaevich",
      "id": "indicator--b90e2630-c5d1-42e3-b2db-758804375546",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '82.147.88.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T20:05:10.000Z",
      "valid_until": "2026-05-12T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T19:14:33.068Z",
      "x_nadsec_last_seen": "2026-04-10T19:14:33.068Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "211860"
      ],
      "x_nadsec_orgs": [
        "Nerushenko Vyacheslav Nikolaevich"
      ]
    },
    {
      "created": "2026-04-10T21:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3110; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--563064fe-435f-457e-b8fa-d7effceacffe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T21:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.1.251.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T21:05:06.000Z",
      "valid_until": "2026-05-12T21:05:04.000Z",
      "x_nadsec_event_count": 3157,
      "x_nadsec_first_seen": "2026-04-10T18:22:53.868Z",
      "x_nadsec_last_seen": "2026-04-10T20:56:02.420Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-04-10T21:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--78ec1ea0-3658-4f81-964d-3345115de691",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T21:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T21:05:06.000Z",
      "valid_until": "2026-05-12T21:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T20:42:35.659Z",
      "x_nadsec_last_seen": "2026-04-10T20:42:35.659Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-04-10T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CA; asn=215540; asn_org=Global Connectivity Solutions Llp",
      "id": "indicator--a5205c8b-16db-4d47-a0a8-1b0cd67689c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.45.177.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T22:05:11.000Z",
      "valid_until": "2026-05-12T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T22:00:34.653Z",
      "x_nadsec_last_seen": "2026-04-10T22:00:34.653Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "215540"
      ],
      "x_nadsec_orgs": [
        "Global Connectivity Solutions Llp"
      ]
    },
    {
      "created": "2026-04-10T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=LK; asn=9329; asn_org=Sri Lanka Telecom Internet; user(top)=**",
      "id": "indicator--b1bebe09-ba39-45b7-9394-6e456148cfbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '220.247.235.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T22:05:11.000Z",
      "valid_until": "2026-05-12T22:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-10T21:23:44.687Z",
      "x_nadsec_last_seen": "2026-04-23T18:51:45.334Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "9329"
      ],
      "x_nadsec_orgs": [
        "Sri Lanka Telecom Internet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-10T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=134; services=pptpd; ports=1723; cc=US; asn=36352; asn_org=HostPapa",
      "id": "indicator--f2188abb-1323-4d93-9dd7-ccf6bf987c97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '67.215.249.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T22:05:11.000Z",
      "valid_until": "2026-05-12T22:05:09.000Z",
      "x_nadsec_event_count": 333,
      "x_nadsec_first_seen": "2026-04-10T21:43:15.375Z",
      "x_nadsec_last_seen": "2026-04-12T03:07:33.768Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "36352"
      ],
      "x_nadsec_orgs": [
        "HostPapa"
      ]
    },
    {
      "created": "2026-04-10T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=ftpd; ports=21; cc=AU; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--b4a6ba9b-f1aa-47dd-9f9f-7bd4aaa84437",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.105.177.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T23:05:05.000Z",
      "valid_until": "2026-05-12T23:05:04.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-10T22:39:15.887Z",
      "x_nadsec_last_seen": "2026-04-10T22:39:49.950Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-10T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--12592e65-5bbb-498c-b2e0-bf60b50a1b36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '58.37.43.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T23:05:05.000Z",
      "valid_until": "2026-05-12T23:05:04.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-04-10T22:26:37.274Z",
      "x_nadsec_last_seen": "2026-04-10T22:31:44.121Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1**1"
      ]
    },
    {
      "created": "2026-04-10T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8b5b33cb-a955-40dc-aaf2-16876a3dcefd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T23:05:05.000Z",
      "valid_until": "2026-05-12T23:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-10T22:27:20.710Z",
      "x_nadsec_last_seen": "2026-04-25T08:41:10.735Z",
      "x_nadsec_ports": [
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-10T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--5ddb96f9-07fe-4a64-90c6-3c66f97ce512",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T23:05:05.000Z",
      "valid_until": "2026-05-12T23:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T22:35:54.657Z",
      "x_nadsec_last_seen": "2026-04-10T22:35:54.657Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-11T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--5fc2451a-96e5-4f7f-bb1a-02e7c416e4fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T00:05:02.000Z",
      "valid_until": "2026-05-13T00:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T23:16:20.152Z",
      "x_nadsec_last_seen": "2026-04-10T23:16:20.152Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-11T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--15387033-bb07-4aed-bf18-39b0054597cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T00:05:02.000Z",
      "valid_until": "2026-05-13T00:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T23:06:05.752Z",
      "x_nadsec_last_seen": "2026-04-10T23:06:05.752Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-11T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--025141f2-548c-4c5b-8d59-3d0fe2dccf79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T00:05:02.000Z",
      "valid_until": "2026-05-13T00:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-10T23:53:59.596Z",
      "x_nadsec_last_seen": "2026-04-10T23:54:00.384Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-11T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MX; asn=8151; asn_org=UNINET; user(top)=**",
      "id": "indicator--0e75461b-8bca-481f-bc28-98aa53e7328e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.232.21.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T00:05:02.000Z",
      "valid_until": "2026-05-13T00:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T23:58:02.592Z",
      "x_nadsec_last_seen": "2026-04-10T23:58:02.592Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-11T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--ed938d28-aeb4-4795-abb9-d3fecb6e0bed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T00:05:02.000Z",
      "valid_until": "2026-05-13T00:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T23:09:38.254Z",
      "x_nadsec_last_seen": "2026-04-10T23:09:38.254Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-11T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d7d1ccc4-b7a2-43fd-8c57-501e2788660e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T00:05:02.000Z",
      "valid_until": "2026-05-13T00:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T23:09:48.533Z",
      "x_nadsec_last_seen": "2026-04-10T23:09:48.533Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-11T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--8abfc61a-f7e3-4230-a985-7b8a9d78ff4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T00:05:02.000Z",
      "valid_until": "2026-05-13T00:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T23:57:47.681Z",
      "x_nadsec_last_seen": "2026-04-10T23:57:47.681Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-11T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--a4b68209-009f-49d6-b052-e4568d2e2819",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '212.220.83.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T00:05:02.000Z",
      "valid_until": "2026-05-13T00:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-10T23:53:46.584Z",
      "x_nadsec_last_seen": "2026-04-10T23:55:53.263Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-11T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--2416def7-950f-49fb-aceb-456f42008713",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T00:05:02.000Z",
      "valid_until": "2026-05-13T00:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T23:56:20.790Z",
      "x_nadsec_last_seen": "2026-04-10T23:56:20.790Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-11T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--e24c625f-1d68-44bb-8996-ef7378f0c7df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T00:05:02.000Z",
      "valid_until": "2026-05-13T00:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-10T23:56:05.372Z",
      "x_nadsec_last_seen": "2026-04-10T23:56:05.372Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-11T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--573ac3bc-69fa-4a57-85d1-704794461584",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '125.25.89.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T01:05:11.000Z",
      "valid_until": "2026-05-13T01:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-11T00:50:39.141Z",
      "x_nadsec_last_seen": "2026-04-11T00:51:04.392Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-04-11T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--f6625ede-ade2-490a-ad10-31559272cee7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.90.5.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T01:05:11.000Z",
      "valid_until": "2026-05-13T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T00:59:39.581Z",
      "x_nadsec_last_seen": "2026-04-11T00:59:39.581Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-11T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=SG; asn=8075; asn_org=Microsoft Corporation; user(top)=**",
      "id": "indicator--208c04ec-cf62-4af5-8ea1-4dae32dc900c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.65.186.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T01:05:11.000Z",
      "valid_until": "2026-05-13T01:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-11T00:57:09.981Z",
      "x_nadsec_last_seen": "2026-04-23T04:02:51.742Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-11T02:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=24547; asn_org=Hebei Mobile Communication Company Limited",
      "id": "indicator--ebfa5bd8-c82a-47b8-a69f-4e637e296b33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T02:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '120.211.32.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T02:05:05.000Z",
      "valid_until": "2026-05-13T02:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-11T01:15:10.247Z",
      "x_nadsec_last_seen": "2026-04-25T07:59:35.362Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "24547"
      ],
      "x_nadsec_orgs": [
        "Hebei Mobile Communication Company Limited"
      ]
    },
    {
      "created": "2026-04-11T02:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3b0d852c-e7bd-4dc7-baf5-78f265ada713",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T02:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T02:05:05.000Z",
      "valid_until": "2026-05-13T02:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T01:06:16.137Z",
      "x_nadsec_last_seen": "2026-04-11T01:06:16.137Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-11T02:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--20491006-5c5a-4e90-afe4-e3898be99529",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T02:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T02:05:05.000Z",
      "valid_until": "2026-05-13T02:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T01:06:17.117Z",
      "x_nadsec_last_seen": "2026-04-11T01:06:17.117Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-11T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8e3acc7c-5d55-4655-8099-d49bd15f7809",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T03:05:10.000Z",
      "valid_until": "2026-05-13T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-11T02:25:17.613Z",
      "x_nadsec_last_seen": "2026-04-11T02:25:18.269Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-11T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--25b16f2c-5843-4394-b415-dc751882dbd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T03:05:10.000Z",
      "valid_until": "2026-05-13T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-11T02:21:29.493Z",
      "x_nadsec_last_seen": "2026-04-11T02:21:29.859Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-11T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=35298; asn_org=PJSC MegaFon",
      "id": "indicator--962460d9-491a-427b-9a5c-9cb37c88b93b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '78.41.100.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T03:05:10.000Z",
      "valid_until": "2026-05-13T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-11T02:53:53.088Z",
      "x_nadsec_last_seen": "2026-04-11T02:55:59.723Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "35298"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-04-11T04:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--2395bd79-e099-40eb-815b-48a672afba3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T04:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '125.36.254.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T04:05:56.000Z",
      "valid_until": "2026-05-13T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T03:48:26.946Z",
      "x_nadsec_last_seen": "2026-04-11T03:48:26.946Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-04-11T04:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=SC; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--da4c5267-27a0-412e-87fc-edf02ee9b52c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T04:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T04:05:56.000Z",
      "valid_until": "2026-05-13T04:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-11T03:25:49.554Z",
      "x_nadsec_last_seen": "2026-04-29T09:20:33.952Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-04-11T04:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--934ae654-8db3-41f3-b649-c1c46b361615",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T04:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '171.116.41.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T04:05:56.000Z",
      "valid_until": "2026-05-13T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T03:48:35.210Z",
      "x_nadsec_last_seen": "2026-04-11T03:48:35.210Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-04-11T04:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--6bddd752-e969-417a-8888-5e40cd8fc9f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T04:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.119.225.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T04:05:56.000Z",
      "valid_until": "2026-05-13T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T03:48:25.933Z",
      "x_nadsec_last_seen": "2026-04-11T03:48:25.933Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-04-11T04:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--6c1ffb75-f44b-464c-b0d1-b28d901f7dcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T04:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.118.24.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T04:05:56.000Z",
      "valid_until": "2026-05-13T04:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-11T03:30:21.679Z",
      "x_nadsec_last_seen": "2026-04-11T03:30:22.382Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-11T04:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=17621; asn_org=China Unicom Shanghai network",
      "id": "indicator--945fb708-b02b-4d74-b87f-8fd35012579f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T04:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '223.166.22.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T04:05:56.000Z",
      "valid_until": "2026-05-13T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T03:48:17.939Z",
      "x_nadsec_last_seen": "2026-04-11T03:48:17.939Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "17621"
      ],
      "x_nadsec_orgs": [
        "China Unicom Shanghai network"
      ]
    },
    {
      "created": "2026-04-11T04:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--f5f6d043-2a62-486f-a235-95fdc9487cdf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T04:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '49.48.199.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T04:05:56.000Z",
      "valid_until": "2026-05-13T04:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-11T03:22:03.303Z",
      "x_nadsec_last_seen": "2026-04-11T03:28:20.498Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-04-11T04:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--2c5d8925-12d7-4691-944f-c67c2a8bc51c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T04:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '59.173.109.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T04:05:56.000Z",
      "valid_until": "2026-05-13T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T03:48:28.090Z",
      "x_nadsec_last_seen": "2026-04-11T03:48:28.090Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-11T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--eae875d8-7dd4-4b48-a135-f8ce47a43015",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '106.117.111.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T05:05:11.000Z",
      "valid_until": "2026-05-13T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T05:01:05.047Z",
      "x_nadsec_last_seen": "2026-04-11T05:01:05.047Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-11T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--7c4ab538-e0a6-45ec-a7d8-8c122a5dfba6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.161.7.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T05:05:11.000Z",
      "valid_until": "2026-05-13T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-11T05:02:48.190Z",
      "x_nadsec_last_seen": "2026-04-11T05:04:52.943Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-11T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--e3a50a29-0094-414e-9dc1-01d52773827d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.177.56.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T05:05:11.000Z",
      "valid_until": "2026-05-13T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-11T05:01:44.019Z",
      "x_nadsec_last_seen": "2026-04-11T05:03:50.025Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-04-11T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--ddb61e5c-c511-45c8-96b5-1adf6c875d50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T05:05:11.000Z",
      "valid_until": "2026-05-13T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-11T05:04:24.088Z",
      "x_nadsec_last_seen": "2026-04-11T05:05:37.959Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-04-11T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--96680d90-ac99-4f22-be22-4fcc891deb59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T05:05:11.000Z",
      "valid_until": "2026-05-13T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-11T05:04:33.825Z",
      "x_nadsec_last_seen": "2026-04-11T05:05:27.431Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-04-11T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--f72b354f-d38a-40a2-be6e-90b308568a8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T05:05:11.000Z",
      "valid_until": "2026-05-13T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T05:04:41.831Z",
      "x_nadsec_last_seen": "2026-04-11T05:04:41.831Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-04-11T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--11387296-69b7-4202-9e9f-40fcb066339b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T05:05:11.000Z",
      "valid_until": "2026-05-13T05:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-11T05:04:31.408Z",
      "x_nadsec_last_seen": "2026-04-11T05:05:22.408Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-04-11T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--60bfa7e3-8ebd-4188-bc02-ae055eafee3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T05:05:11.000Z",
      "valid_until": "2026-05-13T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T04:32:23.990Z",
      "x_nadsec_last_seen": "2026-04-11T04:32:23.990Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-11T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrord; ports=42; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--372351e7-971c-413d-b856-977e470641f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T05:05:11.000Z",
      "valid_until": "2026-05-13T05:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-11T04:27:52.833Z",
      "x_nadsec_last_seen": "2026-04-22T16:06:06.572Z",
      "x_nadsec_ports": [
        "81",
        "42",
        "1883",
        "35007"
      ],
      "x_nadsec_services": [
        "httpd",
        "mirrorc",
        "mirrord",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-11T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--8e7ffa30-3222-4e17-b62e-2a4cb7291058",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '161.35.11.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T06:05:12.000Z",
      "valid_until": "2026-05-13T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-11T05:24:30.345Z",
      "x_nadsec_last_seen": "2026-04-19T03:09:04.282Z",
      "x_nadsec_ports": [
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-11T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--7344ec5e-8a2e-43f2-a6f5-b7d9bfb3d557",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.124.175.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T06:05:12.000Z",
      "valid_until": "2026-05-13T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-11T05:22:23.606Z",
      "x_nadsec_last_seen": "2026-04-11T05:22:33.765Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-11T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--8cf190a7-9a6a-4dfd-9dc4-33df723da90c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '61.155.66.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T06:05:12.000Z",
      "valid_until": "2026-05-13T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T05:50:00.282Z",
      "x_nadsec_last_seen": "2026-04-11T05:50:00.282Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-11T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=LV; asn=12578; asn_org=SIA Tet",
      "id": "indicator--2cf0ad1f-0a88-4960-921e-e5176409562e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '80.232.162.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T06:05:12.000Z",
      "valid_until": "2026-05-13T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-11T05:56:38.529Z",
      "x_nadsec_last_seen": "2026-04-11T05:57:35.010Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LV"
      ],
      "x_nadsec_asns": [
        "12578"
      ],
      "x_nadsec_orgs": [
        "SIA Tet"
      ]
    },
    {
      "created": "2026-04-11T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--07c289a9-6c78-4ab4-9498-f5aaae152185",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T06:05:12.000Z",
      "valid_until": "2026-05-13T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-11T05:16:15.256Z",
      "x_nadsec_last_seen": "2026-04-28T03:36:56.352Z",
      "x_nadsec_ports": [
        "445",
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-11T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=215540; asn_org=Global Connectivity Solutions Llp",
      "id": "indicator--43e79460-1aa8-4804-a85e-19a85267bccc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '92.118.112.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T06:05:12.000Z",
      "valid_until": "2026-05-13T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T05:27:56.830Z",
      "x_nadsec_last_seen": "2026-04-11T05:27:56.830Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "215540"
      ],
      "x_nadsec_orgs": [
        "Global Connectivity Solutions Llp"
      ]
    },
    {
      "created": "2026-04-11T07:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=70; services=mysqld; ports=3306; cc=IN; asn=132335; asn_org=LEAPSWITCH NETWORKS PRIVATE LIMITED; user(top)=r**t",
      "id": "indicator--27852f18-505c-411f-b330-46fc191be61a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T07:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.156.20.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T07:05:06.000Z",
      "valid_until": "2026-05-13T07:05:04.000Z",
      "x_nadsec_event_count": 70,
      "x_nadsec_first_seen": "2026-04-11T06:43:58.243Z",
      "x_nadsec_last_seen": "2026-04-11T06:45:10.999Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132335"
      ],
      "x_nadsec_orgs": [
        "LEAPSWITCH NETWORKS PRIVATE LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-11T07:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--090ac57e-cac8-4406-af7e-45c5635cdb09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T07:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.177.112.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T07:05:06.000Z",
      "valid_until": "2026-05-13T07:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-11T06:38:05.382Z",
      "x_nadsec_last_seen": "2026-04-11T06:38:05.658Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-11T07:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--30d1c40c-a3be-42ce-808b-f7fd506db4bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T07:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T07:05:06.000Z",
      "valid_until": "2026-05-13T07:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-11T06:54:39.877Z",
      "x_nadsec_last_seen": "2026-04-21T16:09:41.039Z",
      "x_nadsec_ports": [
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-11T07:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--577bed55-c584-43c0-bd39-c04d78270772",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T07:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.124.173.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T07:05:06.000Z",
      "valid_until": "2026-05-13T07:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-11T06:43:19.309Z",
      "x_nadsec_last_seen": "2026-04-11T06:43:19.700Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-11T07:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.; user(top)=**",
      "id": "indicator--4d8ae6a8-9ab0-426e-86d5-f7e3984dd7a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T07:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '59.144.74.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T07:05:06.000Z",
      "valid_until": "2026-05-13T07:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T06:31:52.139Z",
      "x_nadsec_last_seen": "2026-04-11T06:31:52.139Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-11T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=34955; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--22357758-71ef-4bd6-ae0f-07415c2a2034",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '162.216.150.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T09:05:11.000Z",
      "valid_until": "2026-05-13T09:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-11T08:07:24.473Z",
      "x_nadsec_last_seen": "2026-04-11T08:07:24.477Z",
      "x_nadsec_ports": [
        "42",
        "34955"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-11T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=SA; asn=35819; asn_org=Etihad Etisalat, a joint stock company",
      "id": "indicator--aa6259c6-f553-4fb5-a257-061f288bef8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.81.0.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T09:05:11.000Z",
      "valid_until": "2026-05-13T09:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-11T08:06:55.098Z",
      "x_nadsec_last_seen": "2026-04-11T08:06:55.127Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "35819"
      ],
      "x_nadsec_orgs": [
        "Etihad Etisalat, a joint stock company"
      ]
    },
    {
      "created": "2026-04-11T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=UY; asn=6057; asn_org=Administracion Nacional de Telecomunicaciones; user(top)=**",
      "id": "indicator--1ef8186f-9541-49da-84a5-27c044c04036",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '179.25.114.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T09:05:11.000Z",
      "valid_until": "2026-05-13T09:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T08:43:20.014Z",
      "x_nadsec_last_seen": "2026-04-11T08:43:20.014Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "UY"
      ],
      "x_nadsec_asns": [
        "6057"
      ],
      "x_nadsec_orgs": [
        "Administracion Nacional de Telecomunicaciones"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-11T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=8386; asn_org=Vodafone Net Iletisim Hizmetler AS",
      "id": "indicator--1521d6e2-34f2-44bd-8628-f062aaaf30c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '188.3.0.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T09:05:11.000Z",
      "valid_until": "2026-05-13T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-11T09:01:31.701Z",
      "x_nadsec_last_seen": "2026-04-11T09:03:38.585Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "8386"
      ],
      "x_nadsec_orgs": [
        "Vodafone Net Iletisim Hizmetler AS"
      ]
    },
    {
      "created": "2026-04-11T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--e6e89dbd-cece-412c-aa32-a81735367c17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '217.165.254.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T09:05:11.000Z",
      "valid_until": "2026-05-13T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-11T08:54:56.959Z",
      "x_nadsec_last_seen": "2026-04-11T08:57:03.082Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ]
    },
    {
      "created": "2026-04-11T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--10d194e5-e9c9-457b-a718-68584832eb89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.227.4.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T09:05:11.000Z",
      "valid_until": "2026-05-13T09:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T08:21:34.761Z",
      "x_nadsec_last_seen": "2026-04-11T08:21:34.761Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-11T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--0253b16c-fac2-4294-88a5-5447fb52a140",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T09:05:11.000Z",
      "valid_until": "2026-05-13T09:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-11T08:54:02.047Z",
      "x_nadsec_last_seen": "2026-04-26T01:34:48.368Z",
      "x_nadsec_ports": [
        "81",
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-11T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; user(top)=**; pass(top)=!*******e",
      "id": "indicator--ea73bb3a-b848-4041-b9b4-a726cd501d38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '122.139.97.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:05:11.000Z",
      "valid_until": "2026-05-13T10:05:09.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-04-11T09:38:55.437Z",
      "x_nadsec_last_seen": "2026-04-11T09:41:43.054Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "!*******e"
      ]
    },
    {
      "created": "2026-04-11T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--b87573bb-b780-448a-ada5-35527c27248b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.135.74.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:05:11.000Z",
      "valid_until": "2026-05-13T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T09:15:16.319Z",
      "x_nadsec_last_seen": "2026-04-11T09:15:16.319Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-11T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--ef72d438-f868-4a0f-b423-daffd8978ea4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.96.237.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:05:11.000Z",
      "valid_until": "2026-05-13T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-11T09:26:22.655Z",
      "x_nadsec_last_seen": "2026-04-11T09:26:22.726Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-04-11T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--c641d8af-2425-4991-98d6-4f06767eb117",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '171.37.47.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:05:11.000Z",
      "valid_until": "2026-05-13T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T09:15:12.025Z",
      "x_nadsec_last_seen": "2026-04-11T09:15:12.025Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-04-11T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--1194459a-4d7d-4cae-83a7-defa2488815d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.138.158.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:05:11.000Z",
      "valid_until": "2026-05-13T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T09:15:13.263Z",
      "x_nadsec_last_seen": "2026-04-11T09:15:13.263Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-11T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--908c080b-fa15-4609-901c-a0d67b8e769f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.71.94.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:05:11.000Z",
      "valid_until": "2026-05-13T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-11T09:09:58.777Z",
      "x_nadsec_last_seen": "2026-04-11T09:12:03.730Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-04-11T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=17621; asn_org=China Unicom Shanghai network",
      "id": "indicator--ad55c147-bb61-4bba-8854-4a1c31860a4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '223.166.22.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:05:11.000Z",
      "valid_until": "2026-05-13T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T09:15:14.415Z",
      "x_nadsec_last_seen": "2026-04-11T09:15:14.415Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "17621"
      ],
      "x_nadsec_orgs": [
        "China Unicom Shanghai network"
      ]
    },
    {
      "created": "2026-04-11T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--15908437-1380-4748-8259-f014fcae091f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '58.19.83.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:05:11.000Z",
      "valid_until": "2026-05-13T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T09:15:03.991Z",
      "x_nadsec_last_seen": "2026-04-11T09:15:03.991Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-04-11T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=140726; asn_org=UNICOM AnHui province network",
      "id": "indicator--2029d6d6-725c-45d5-8f4d-070ab928ad02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '58.243.46.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:05:11.000Z",
      "valid_until": "2026-05-13T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T09:15:18.000Z",
      "x_nadsec_last_seen": "2026-04-11T09:15:18.000Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "140726"
      ],
      "x_nadsec_orgs": [
        "UNICOM AnHui province network"
      ]
    },
    {
      "created": "2026-04-11T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=smbd; ports=445; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--cefa8ced-6672-4a0d-93c1-e3f250f8169b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.197.101.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T11:05:10.000Z",
      "valid_until": "2026-05-13T11:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-04-11T10:17:15.227Z",
      "x_nadsec_last_seen": "2026-04-11T10:19:31.316Z",
      "x_nadsec_ports": [
        "3306",
        "21",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "27017"
      ],
      "x_nadsec_services": [
        "mysqld",
        "epmapper",
        "ftpd",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-11T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--60803332-6db1-47ac-84d3-ac8b41c10dc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '171.5.219.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T11:05:10.000Z",
      "valid_until": "2026-05-13T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-11T10:39:52.348Z",
      "x_nadsec_last_seen": "2026-04-11T10:41:56.764Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-04-11T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=36352; asn_org=HostPapa",
      "id": "indicator--e09fa7cf-c404-4c30-84c3-0bb61e7aef37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.95.86.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T11:05:10.000Z",
      "valid_until": "2026-05-13T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-11T10:24:22.222Z",
      "x_nadsec_last_seen": "2026-04-30T02:28:41.452Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "36352"
      ],
      "x_nadsec_orgs": [
        "HostPapa"
      ]
    },
    {
      "created": "2026-04-11T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--06e0866d-4e74-44b9-947e-333ea070d602",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.95.104.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T11:05:10.000Z",
      "valid_until": "2026-05-13T11:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-11T10:52:00.277Z",
      "x_nadsec_last_seen": "2026-04-11T10:58:16.885Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-11T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=56209; asn_org=AIRLINK TELESERVICES PRIVATE LIMITED",
      "id": "indicator--f1f09a05-1bf1-4f33-9cb0-76c14a8c8373",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.181.34.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T12:05:11.000Z",
      "valid_until": "2026-05-13T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-11T12:01:45.979Z",
      "x_nadsec_last_seen": "2026-04-11T12:03:51.097Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "56209"
      ],
      "x_nadsec_orgs": [
        "AIRLINK TELESERVICES PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-04-11T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--83dfd59b-7d5e-4ba9-afe9-2b22655b3e3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T12:05:11.000Z",
      "valid_until": "2026-05-13T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T11:21:41.876Z",
      "x_nadsec_last_seen": "2026-04-11T11:21:41.876Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-11T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=55836; asn_org=Reliance Jio Infocomm Limited",
      "id": "indicator--9fe71be7-f324-449b-97b3-5d7cf3bde889",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '115.246.11.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T13:05:11.000Z",
      "valid_until": "2026-05-13T13:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-11T12:29:29.474Z",
      "x_nadsec_last_seen": "2026-04-21T08:20:54.469Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55836"
      ],
      "x_nadsec_orgs": [
        "Reliance Jio Infocomm Limited"
      ]
    },
    {
      "created": "2026-04-11T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a6db1afa-5a9e-4269-a904-da8702622578",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.202.118.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T13:05:11.000Z",
      "valid_until": "2026-05-13T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T12:44:20.494Z",
      "x_nadsec_last_seen": "2026-04-11T12:44:20.494Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-11T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--9b632445-d009-4bc8-b7ed-f072a89a8d31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.163.15.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T13:05:11.000Z",
      "valid_until": "2026-05-13T13:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-11T12:20:54.835Z",
      "x_nadsec_last_seen": "2026-04-29T17:08:27.791Z",
      "x_nadsec_ports": [
        "3306",
        "1723"
      ],
      "x_nadsec_services": [
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-11T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=SG; asn=18106; asn_org=Viewqwest Pte Ltd",
      "id": "indicator--8da62290-674b-40c7-997e-9f8a211608e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '202.55.84.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T13:05:11.000Z",
      "valid_until": "2026-05-13T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-11T12:43:16.571Z",
      "x_nadsec_last_seen": "2026-04-11T12:43:16.882Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "18106"
      ],
      "x_nadsec_orgs": [
        "Viewqwest Pte Ltd"
      ]
    },
    {
      "created": "2026-04-11T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=61; services=mysqld; ports=3306; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--9fa667c6-8f94-4841-8d48-6949154dbc5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.212.30.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T13:05:11.000Z",
      "valid_until": "2026-05-13T13:05:09.000Z",
      "x_nadsec_event_count": 61,
      "x_nadsec_first_seen": "2026-04-11T12:07:37.943Z",
      "x_nadsec_last_seen": "2026-04-11T12:12:34.195Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "e******e"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-11T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d3b9ff9a-ecdc-494b-9fa7-dfa3a25c08b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.124.174.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T13:05:11.000Z",
      "valid_until": "2026-05-13T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T12:27:40.990Z",
      "x_nadsec_last_seen": "2026-04-11T12:27:40.990Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-11T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=SG; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--13900b00-8702-4303-8acd-f21d8100d531",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '54.169.169.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T13:05:11.000Z",
      "valid_until": "2026-05-13T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-11T12:14:31.782Z",
      "x_nadsec_last_seen": "2026-04-11T12:14:32.582Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-11T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=PL; asn=212238; asn_org=Datacamp Limited; user(top)=a*******s; pass(top)=m*****a@example.com",
      "id": "indicator--f4454849-04d5-4aff-90ea-c91990184787",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '193.42.99.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T14:05:10.000Z",
      "valid_until": "2026-05-13T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T13:29:37.484Z",
      "x_nadsec_last_seen": "2026-04-11T13:29:37.484Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "m*****************m"
      ]
    },
    {
      "created": "2026-04-11T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--a847f3d4-97e4-4d97-add2-009492a4150c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '2.50.155.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T14:05:10.000Z",
      "valid_until": "2026-05-13T14:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-11T13:45:13.766Z",
      "x_nadsec_last_seen": "2026-04-11T13:45:13.904Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ]
    },
    {
      "created": "2026-04-11T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--11ad6527-0667-4081-972e-edacb5508e3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T14:05:10.000Z",
      "valid_until": "2026-05-13T14:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-11T13:11:21.251Z",
      "x_nadsec_last_seen": "2026-04-11T13:11:43.845Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-11T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--34fb5ba5-215f-4c5b-bc32-c37a8f874d71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.160.225.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T17:05:13.000Z",
      "valid_until": "2026-05-13T17:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-11T16:43:03.241Z",
      "x_nadsec_last_seen": "2026-04-11T16:45:07.973Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-11T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a6ecf693-ded0-4e16-9c24-e34b8226303b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T17:05:13.000Z",
      "valid_until": "2026-05-13T17:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-11T16:07:23.453Z",
      "x_nadsec_last_seen": "2026-04-11T16:07:24.105Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-11T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--d1772fdf-fb8e-46be-969c-b7715bcc1fa4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.76.78.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T17:05:13.000Z",
      "valid_until": "2026-05-13T17:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-11T16:19:34.994Z",
      "x_nadsec_last_seen": "2026-04-13T01:44:11.803Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-11T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=41; services=httpd; ports=81; cc=DE; asn=16276; asn_org=OVH SAS",
      "id": "indicator--05a9549b-ca0e-42d3-b38c-f586b4db876a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '57.129.35.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T17:05:13.000Z",
      "valid_until": "2026-05-13T17:05:08.000Z",
      "x_nadsec_event_count": 41,
      "x_nadsec_first_seen": "2026-04-11T16:38:28.771Z",
      "x_nadsec_last_seen": "2026-04-11T16:39:03.630Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ]
    },
    {
      "created": "2026-04-11T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--fbe071a7-3a83-44b4-942d-31465aa19894",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.121.123.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T18:05:11.000Z",
      "valid_until": "2026-05-13T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-11T17:22:14.439Z",
      "x_nadsec_last_seen": "2026-04-11T17:22:14.823Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-11T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--43dcf991-0216-485d-b1c0-fe3a6892f966",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T18:05:11.000Z",
      "valid_until": "2026-05-13T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T17:16:01.845Z",
      "x_nadsec_last_seen": "2026-04-11T17:16:01.845Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-11T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--8cf4508d-70a7-479f-9723-c05b8e6e0823",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.26.235.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T18:05:11.000Z",
      "valid_until": "2026-05-13T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-11T18:02:24.300Z",
      "x_nadsec_last_seen": "2026-04-11T18:04:31.391Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-04-11T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--5d583521-2903-4f4f-beae-6fb1b297ab04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T18:05:11.000Z",
      "valid_until": "2026-05-13T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T17:14:47.370Z",
      "x_nadsec_last_seen": "2026-04-11T17:14:47.370Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-11T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--ff97a5de-5e4b-4a4a-ba3c-4cc11181a7a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T18:05:11.000Z",
      "valid_until": "2026-05-13T18:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-11T17:14:23.459Z",
      "x_nadsec_last_seen": "2026-04-11T17:14:48.040Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-11T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=TR; asn=12735; asn_org=TurkNet Iletisim Hizmetleri A.S.",
      "id": "indicator--86064a25-0016-4915-a746-3e54cba5d4ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '95.70.238.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T18:05:11.000Z",
      "valid_until": "2026-05-13T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T17:44:15.115Z",
      "x_nadsec_last_seen": "2026-04-11T17:44:15.115Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "12735"
      ],
      "x_nadsec_orgs": [
        "TurkNet Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-04-11T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=KR; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--5022a876-ff77-4161-b3cd-577c5e7fdefb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.194.248.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T19:05:11.000Z",
      "valid_until": "2026-05-13T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-11T18:22:49.527Z",
      "x_nadsec_last_seen": "2026-04-11T18:23:10.738Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-11T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--836b7f3a-0e8d-439c-a38b-d6da9651dfb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.198.172.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T19:05:11.000Z",
      "valid_until": "2026-05-13T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T18:39:13.431Z",
      "x_nadsec_last_seen": "2026-04-11T18:39:13.431Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-11T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--c0194f2c-8cee-4f30-bd52-f05d5dd6cebc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '183.82.118.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T19:05:11.000Z",
      "valid_until": "2026-05-13T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-11T18:26:30.801Z",
      "x_nadsec_last_seen": "2026-04-11T18:28:34.931Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-04-11T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EC; asn=28006; asn_org=CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP",
      "id": "indicator--d9f09161-101e-45a8-bacf-c155f1a99d14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.46.87.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T19:05:11.000Z",
      "valid_until": "2026-05-13T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-11T18:32:44.048Z",
      "x_nadsec_last_seen": "2026-04-11T18:33:58.020Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "28006"
      ],
      "x_nadsec_orgs": [
        "CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP"
      ]
    },
    {
      "created": "2026-04-11T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--31341390-6d73-4521-bb70-0d77b812e547",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.57.245.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T19:05:11.000Z",
      "valid_until": "2026-05-13T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-11T18:55:11.119Z",
      "x_nadsec_last_seen": "2026-04-11T18:57:18.416Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-04-11T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CH; asn=15169; asn_org=Google LLC",
      "id": "indicator--0444e682-5311-4995-91b8-9218f315847b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.216.195.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T19:05:11.000Z",
      "valid_until": "2026-05-13T19:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-11T18:13:19.316Z",
      "x_nadsec_last_seen": "2026-04-26T02:34:43.050Z",
      "x_nadsec_ports": [
        "3306",
        "27017",
        "445"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "15169"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-11T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--8ee6a75d-23d1-41b1-ad36-f9d83380f202",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.228.53.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T19:05:11.000Z",
      "valid_until": "2026-05-13T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-11T18:06:43.527Z",
      "x_nadsec_last_seen": "2026-04-11T18:06:43.864Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-11T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RS; asn=8400; asn_org=TELEKOM SRBIJA a.d.",
      "id": "indicator--6a6df85f-1ae3-4665-a570-9bd882faae27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.101.9.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T19:05:11.000Z",
      "valid_until": "2026-05-13T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T18:25:06.863Z",
      "x_nadsec_last_seen": "2026-04-11T18:25:06.863Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RS"
      ],
      "x_nadsec_asns": [
        "8400"
      ],
      "x_nadsec_orgs": [
        "TELEKOM SRBIJA a.d."
      ]
    },
    {
      "created": "2026-04-11T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--56bb44de-04d6-45e9-a29c-3f8bdf07b7b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.168.6.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T20:05:02.000Z",
      "valid_until": "2026-05-13T20:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T19:20:17.448Z",
      "x_nadsec_last_seen": "2026-04-11T19:20:17.448Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-11T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ac5711c6-8342-4789-ba08-7313ea823c4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.98.164.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T20:05:02.000Z",
      "valid_until": "2026-05-13T20:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-11T19:52:45.966Z",
      "x_nadsec_last_seen": "2026-04-20T16:58:14.615Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-11T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--60992cad-71b1-4607-a403-316bce431b8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T20:05:02.000Z",
      "valid_until": "2026-05-13T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-11T19:07:21.015Z",
      "x_nadsec_last_seen": "2026-04-19T06:09:40.841Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-11T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8ce29ab2-4f13-4ea0-8fda-3c8851507542",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T20:05:02.000Z",
      "valid_until": "2026-05-13T20:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T19:48:06.614Z",
      "x_nadsec_last_seen": "2026-04-11T19:48:06.614Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-11T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--4b041b09-762b-41e3-b217-bc83e77b1c45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '98.92.66.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T20:05:02.000Z",
      "valid_until": "2026-05-13T20:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T20:03:27.643Z",
      "x_nadsec_last_seen": "2026-04-11T20:03:27.643Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-11T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--cc430da0-85ef-46fa-b36d-159f830415b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '164.92.228.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T21:05:10.000Z",
      "valid_until": "2026-05-13T21:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-11T20:39:59.048Z",
      "x_nadsec_last_seen": "2026-04-11T20:40:10.341Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-11T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--49941c27-deb7-4661-9b9f-f10a870af731",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '167.99.134.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T21:05:10.000Z",
      "valid_until": "2026-05-13T21:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T20:40:11.375Z",
      "x_nadsec_last_seen": "2026-04-11T20:40:11.375Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-11T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=16735; asn_org=ALGAR TELECOM SA",
      "id": "indicator--ab24bad7-e418-4eef-b546-efc3a0fd98c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.37.81.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T21:05:10.000Z",
      "valid_until": "2026-05-13T21:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-11T20:57:22.880Z",
      "x_nadsec_last_seen": "2026-04-11T20:59:32.185Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "16735"
      ],
      "x_nadsec_orgs": [
        "ALGAR TELECOM SA"
      ]
    },
    {
      "created": "2026-04-11T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a11d2777-aed8-42bb-904e-7314dccc22be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.163.20.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T21:05:10.000Z",
      "valid_until": "2026-05-13T21:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-11T20:22:22.993Z",
      "x_nadsec_last_seen": "2026-04-11T20:22:33.137Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-11T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--8b41574f-b1f4-4958-9110-d73a2399cbba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.14.33.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T21:05:10.000Z",
      "valid_until": "2026-05-13T21:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-11T20:23:52.147Z",
      "x_nadsec_last_seen": "2026-04-26T12:02:31.409Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-11T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=httpd; ports=81; cc=BR; asn=267062; asn_org=W-NET TELLECOM EIRELI ME",
      "id": "indicator--f286e528-3b9d-4fe9-9404-627f60874dc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.228.8.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T21:05:10.000Z",
      "valid_until": "2026-05-13T21:05:08.000Z",
      "x_nadsec_event_count": 212,
      "x_nadsec_first_seen": "2026-04-11T20:11:16.940Z",
      "x_nadsec_last_seen": "2026-04-23T20:00:43.904Z",
      "x_nadsec_ports": [
        "27017",
        "21",
        "1723",
        "3306",
        "81",
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "mongod",
        "ftpd",
        "pptpd",
        "mysqld",
        "httpd",
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "267062"
      ],
      "x_nadsec_orgs": [
        "W-NET TELLECOM EIRELI ME"
      ]
    },
    {
      "created": "2026-04-11T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=epmapper; ports=135; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--3be1ff6d-1fb3-4b4b-ad7d-58d48f57e5ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '8.219.153.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T21:05:10.000Z",
      "valid_until": "2026-05-13T21:05:08.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-11T20:36:01.526Z",
      "x_nadsec_last_seen": "2026-04-11T20:36:41.529Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-11T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=12; services=mssqld; ports=1433; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--d348ecf8-b12f-4d50-a730-9aec7a7229c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '101.108.114.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T22:05:10.000Z",
      "valid_until": "2026-05-13T22:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-04-11T21:16:34.232Z",
      "x_nadsec_last_seen": "2026-04-11T21:16:38.705Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1**6"
      ]
    },
    {
      "created": "2026-04-11T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--25cb80ff-8a3c-43a3-8f82-be974bcd4681",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.248.135.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T22:05:10.000Z",
      "valid_until": "2026-05-13T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T21:27:10.117Z",
      "x_nadsec_last_seen": "2026-04-11T21:27:10.117Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-11T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=135175; asn_org=Facts Online Pvt Ltd; user(top)=**",
      "id": "indicator--b31fc539-340a-4f50-86ea-e8d6025df4de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.61.72.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T22:05:10.000Z",
      "valid_until": "2026-05-13T22:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-11T21:16:17.551Z",
      "x_nadsec_last_seen": "2026-04-20T16:55:04.466Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135175"
      ],
      "x_nadsec_orgs": [
        "Facts Online Pvt Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-11T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=EC; asn=27947; asn_org=Telconet S.A; user(top)=**",
      "id": "indicator--56859250-6687-4494-b143-744a5753c60f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '181.39.108.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T22:05:10.000Z",
      "valid_until": "2026-05-13T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T21:47:04.385Z",
      "x_nadsec_last_seen": "2026-04-11T21:47:04.385Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "27947"
      ],
      "x_nadsec_orgs": [
        "Telconet S.A"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-11T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=CH; asn=15169; asn_org=Google LLC",
      "id": "indicator--cd8cdb13-f822-481d-a672-6e77fe22a1eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.216.140.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T22:05:10.000Z",
      "valid_until": "2026-05-13T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-11T21:08:19.933Z",
      "x_nadsec_last_seen": "2026-04-11T21:08:30.184Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "15169"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-11T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--3c895926-bd06-4965-b357-2a4c75b72441",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.228.53.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T22:05:10.000Z",
      "valid_until": "2026-05-13T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-11T21:21:31.780Z",
      "x_nadsec_last_seen": "2026-04-11T21:22:01.782Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-11T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=GB; asn=209605; asn_org=UAB Host Baltic",
      "id": "indicator--29f9c37d-491d-4908-8d7c-adce9bdbe21a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.224.92.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T22:05:10.000Z",
      "valid_until": "2026-05-13T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-11T21:32:31.355Z",
      "x_nadsec_last_seen": "2026-04-15T00:00:06.398Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "209605"
      ],
      "x_nadsec_orgs": [
        "UAB Host Baltic"
      ]
    },
    {
      "created": "2026-04-11T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--e91110c1-47b5-426b-ba82-731109a8dcff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T22:05:10.000Z",
      "valid_until": "2026-05-13T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T22:03:28.901Z",
      "x_nadsec_last_seen": "2026-04-11T22:03:28.901Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-11T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--b7a39152-831d-463d-9190-a13b03e29476",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T22:05:10.000Z",
      "valid_until": "2026-05-13T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T22:02:49.348Z",
      "x_nadsec_last_seen": "2026-04-11T22:02:49.348Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-11T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IT; asn=1267; asn_org=Wind Tre S.p.A.",
      "id": "indicator--ada86f5a-ef30-478c-94e7-5091cef8877d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '151.84.223.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T23:05:10.000Z",
      "valid_until": "2026-05-13T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-11T22:10:22.631Z",
      "x_nadsec_last_seen": "2026-04-15T20:25:03.996Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "1267"
      ],
      "x_nadsec_orgs": [
        "Wind Tre S.p.A."
      ]
    },
    {
      "created": "2026-04-11T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--70dec905-af76-421e-bbe5-feb2dc9586bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T23:05:10.000Z",
      "valid_until": "2026-05-13T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T22:09:08.828Z",
      "x_nadsec_last_seen": "2026-04-11T22:09:08.828Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-11T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--324a5f38-ff16-4120-97fe-b3ab69c633b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T23:05:10.000Z",
      "valid_until": "2026-05-13T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T22:12:40.113Z",
      "x_nadsec_last_seen": "2026-04-11T22:12:40.113Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-11T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--bc7e2700-16c2-4d5b-966f-e70ff36f2095",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T23:05:10.000Z",
      "valid_until": "2026-05-13T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-11T22:31:27.150Z",
      "x_nadsec_last_seen": "2026-04-11T22:31:27.150Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-12T02:06:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=ZA; asn=212238; asn_org=Datacamp Limited",
      "id": "indicator--7bcecee2-e499-4215-a8f8-d7842ca6a8eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:06:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.129.141.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:06:51.000Z",
      "valid_until": "2026-05-14T02:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T02:01:45.244Z",
      "x_nadsec_last_seen": "2026-04-12T02:01:45.244Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ]
    },
    {
      "created": "2026-04-12T02:06:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=212238; asn_org=Datacamp Limited",
      "id": "indicator--e8c8bbc7-3f58-45fc-abc4-8645d5f2e703",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:06:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.219.170.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:06:51.000Z",
      "valid_until": "2026-05-14T02:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T01:31:41.394Z",
      "x_nadsec_last_seen": "2026-04-12T01:31:41.394Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ]
    },
    {
      "created": "2026-04-12T02:06:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=212238; asn_org=Datacamp Limited",
      "id": "indicator--9034d506-3272-49b6-9802-bb60ca60ec21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:06:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.219.171.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:06:51.000Z",
      "valid_until": "2026-05-14T02:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T01:43:30.774Z",
      "x_nadsec_last_seen": "2026-04-12T02:19:05.645Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ]
    },
    {
      "created": "2026-04-12T02:06:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=212238; asn_org=Datacamp Limited",
      "id": "indicator--c4102e1a-78f8-4b9a-bc82-f7896fb6291e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:06:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '150.241.243.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:06:51.000Z",
      "valid_until": "2026-05-14T02:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T01:29:00.882Z",
      "x_nadsec_last_seen": "2026-04-12T01:29:00.882Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ]
    },
    {
      "created": "2026-04-12T02:06:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=212238; asn_org=Datacamp Limited",
      "id": "indicator--b047eb0e-0813-46eb-8b6d-370107ccc8ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:06:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '151.247.120.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:06:51.000Z",
      "valid_until": "2026-05-14T02:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T01:40:18.962Z",
      "x_nadsec_last_seen": "2026-04-12T01:43:46.912Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ]
    },
    {
      "created": "2026-04-12T02:06:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=212238; asn_org=Datacamp Limited",
      "id": "indicator--445b2b2e-bed3-4747-bd5a-762d0e39826b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:06:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '151.247.121.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:06:51.000Z",
      "valid_until": "2026-05-14T02:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T01:33:13.902Z",
      "x_nadsec_last_seen": "2026-04-12T01:49:26.793Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ]
    },
    {
      "created": "2026-04-12T02:06:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=212238; asn_org=Datacamp Limited",
      "id": "indicator--b71b5c6e-9925-40c7-ae68-a305a1c9cdeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:06:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '151.247.124.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:06:51.000Z",
      "valid_until": "2026-05-14T02:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T01:44:04.574Z",
      "x_nadsec_last_seen": "2026-04-12T01:44:04.574Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ]
    },
    {
      "created": "2026-04-12T02:06:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=212238; asn_org=Datacamp Limited",
      "id": "indicator--58ab166d-50fc-40e5-8727-b8702facf401",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:06:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '151.247.125.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:06:51.000Z",
      "valid_until": "2026-05-14T02:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T01:57:01.101Z",
      "x_nadsec_last_seen": "2026-04-12T02:06:30.644Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ]
    },
    {
      "created": "2026-04-12T02:06:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=212238; asn_org=Datacamp Limited",
      "id": "indicator--7afc6d67-773b-40a2-92a4-3dfc969f6b2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:06:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '151.247.126.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:06:51.000Z",
      "valid_until": "2026-05-14T02:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T01:42:38.266Z",
      "x_nadsec_last_seen": "2026-04-12T01:42:38.266Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ]
    },
    {
      "created": "2026-04-12T02:06:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--02e52dc1-cffb-402f-94f5-1bffd5271ff2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:06:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '164.92.89.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:06:51.000Z",
      "valid_until": "2026-05-14T02:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T01:15:20.211Z",
      "x_nadsec_last_seen": "2026-04-12T01:15:20.211Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-12T02:06:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--46f83e5b-64c3-4ae2-9ce6-34e2c5489ef2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:06:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.89.26.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:06:51.000Z",
      "valid_until": "2026-05-14T02:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T01:21:06.203Z",
      "x_nadsec_last_seen": "2026-04-12T01:21:06.598Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-04-12T02:06:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=28191; asn_org=Jupiter Telecomunicacoes e Informatica Ltda; user(top)=**",
      "id": "indicator--6875c3fb-3828-4a11-8685-91e135ecac93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:06:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.90.38.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:06:51.000Z",
      "valid_until": "2026-05-14T02:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T01:05:43.717Z",
      "x_nadsec_last_seen": "2026-04-12T01:05:43.717Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28191"
      ],
      "x_nadsec_orgs": [
        "Jupiter Telecomunicacoes e Informatica Ltda"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-12T02:06:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=212238; asn_org=Datacamp Limited",
      "id": "indicator--5b7d8633-e4de-46de-baab-d16493362535",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:06:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '193.187.109.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:06:51.000Z",
      "valid_until": "2026-05-14T02:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T01:44:36.246Z",
      "x_nadsec_last_seen": "2026-04-12T02:13:11.668Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ]
    },
    {
      "created": "2026-04-12T02:06:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=UA; asn=3257; asn_org=GTT Communications Inc.",
      "id": "indicator--ba893359-7fb0-4fa1-ac51-a179e402d9a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:06:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.160.192.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:06:51.000Z",
      "valid_until": "2026-05-14T02:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T01:42:56.605Z",
      "x_nadsec_last_seen": "2026-04-12T01:42:56.605Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "3257"
      ],
      "x_nadsec_orgs": [
        "GTT Communications Inc."
      ]
    },
    {
      "created": "2026-04-12T02:06:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--f2de1a75-bb98-44d0-8e1d-c3146ac6d6f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:06:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:06:51.000Z",
      "valid_until": "2026-05-14T02:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T01:32:43.568Z",
      "x_nadsec_last_seen": "2026-04-12T01:32:43.568Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-12T02:06:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=212238; asn_org=Datacamp Limited",
      "id": "indicator--4812ea8d-1ccb-4fc6-8fe7-306f9ad8f5d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:06:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '199.181.239.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:06:51.000Z",
      "valid_until": "2026-05-14T02:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T01:34:49.261Z",
      "x_nadsec_last_seen": "2026-04-12T02:09:43.349Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ]
    },
    {
      "created": "2026-04-12T02:06:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=264850; asn_org=TODAS LAS REDES SA",
      "id": "indicator--ba371a68-24d2-4a33-b5f6-ed7f3dd5755b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:06:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '200.10.34.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:06:51.000Z",
      "valid_until": "2026-05-14T02:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T01:43:13.698Z",
      "x_nadsec_last_seen": "2026-04-12T01:43:13.698Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "264850"
      ],
      "x_nadsec_orgs": [
        "TODAS LAS REDES SA"
      ]
    },
    {
      "created": "2026-04-12T02:06:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=212238; asn_org=Datacamp Limited",
      "id": "indicator--920d4ab4-9163-4c83-9f17-f3821b4db845",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:06:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '209.101.149.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:06:51.000Z",
      "valid_until": "2026-05-14T02:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T01:49:08.934Z",
      "x_nadsec_last_seen": "2026-04-12T01:59:13.194Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ]
    },
    {
      "created": "2026-04-12T02:06:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=212238; asn_org=Datacamp Limited",
      "id": "indicator--dbcd0f99-e542-4518-b3c3-0ac57e3ea59f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:06:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '209.101.151.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:06:51.000Z",
      "valid_until": "2026-05-14T02:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T01:47:31.549Z",
      "x_nadsec_last_seen": "2026-04-12T02:11:35.016Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ]
    },
    {
      "created": "2026-04-12T02:06:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=212238; asn_org=Datacamp Limited",
      "id": "indicator--727d271b-90fd-48e8-9429-8a50187322e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:06:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '209.101.203.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:06:51.000Z",
      "valid_until": "2026-05-14T02:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T02:00:07.178Z",
      "x_nadsec_last_seen": "2026-04-12T02:00:07.178Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ]
    },
    {
      "created": "2026-04-12T02:06:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=209372; asn_org=WS Telecom Inc",
      "id": "indicator--9c25ae44-a2cc-43e0-bae2-adfa7e005a91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:06:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '213.170.223.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:06:51.000Z",
      "valid_until": "2026-05-14T02:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T01:56:35.261Z",
      "x_nadsec_last_seen": "2026-04-12T01:59:47.596Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "209372"
      ],
      "x_nadsec_orgs": [
        "WS Telecom Inc"
      ]
    },
    {
      "created": "2026-04-12T02:06:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=US; asn=212238; asn_org=Datacamp Limited",
      "id": "indicator--29b0e902-5bd3-43f5-932a-98a3cbfa5f83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:06:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '216.180.245.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:06:51.000Z",
      "valid_until": "2026-05-14T02:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-12T01:34:12.415Z",
      "x_nadsec_last_seen": "2026-04-12T02:13:59.304Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ]
    },
    {
      "created": "2026-04-12T02:06:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=212238; asn_org=Datacamp Limited",
      "id": "indicator--2c4955fd-d641-48e6-bea0-fd1c86f13bd8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:06:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '216.180.253.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:06:51.000Z",
      "valid_until": "2026-05-14T02:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T02:01:28.136Z",
      "x_nadsec_last_seen": "2026-04-12T02:01:28.136Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ]
    },
    {
      "created": "2026-04-12T02:06:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=212238; asn_org=Datacamp Limited",
      "id": "indicator--5a56fa07-b040-4a09-99bd-5594eb2b8ad1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:06:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '216.185.46.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:06:51.000Z",
      "valid_until": "2026-05-14T02:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T01:28:45.266Z",
      "x_nadsec_last_seen": "2026-04-12T02:01:10.255Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ]
    },
    {
      "created": "2026-04-12T02:06:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--87a7146c-58a6-4306-a7c0-960a44b415d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:06:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '218.75.90.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:06:51.000Z",
      "valid_until": "2026-05-14T02:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-12T01:48:52.125Z",
      "x_nadsec_last_seen": "2026-04-12T01:48:56.755Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-12T02:06:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=212238; asn_org=Datacamp Limited",
      "id": "indicator--07d0cbd8-1fef-4b95-8079-de0ceb125ff5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:06:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.78.44.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:06:51.000Z",
      "valid_until": "2026-05-14T02:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T01:40:30.089Z",
      "x_nadsec_last_seen": "2026-04-12T01:57:41.890Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ]
    },
    {
      "created": "2026-04-12T02:06:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=GI; asn=397044; asn_org=My Tec Sa",
      "id": "indicator--c59cd481-f288-4df4-ac57-fa276a17c98e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:06:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.131.49.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:06:51.000Z",
      "valid_until": "2026-05-14T02:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T01:51:36.412Z",
      "x_nadsec_last_seen": "2026-04-12T01:51:36.412Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "GI"
      ],
      "x_nadsec_asns": [
        "397044"
      ],
      "x_nadsec_orgs": [
        "My Tec Sa"
      ]
    },
    {
      "created": "2026-04-12T02:06:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=212238; asn_org=Datacamp Limited",
      "id": "indicator--6250baa6-1c04-44e3-8631-b01a25359cd1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:06:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '96.62.111.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:06:51.000Z",
      "valid_until": "2026-05-14T02:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T01:59:31.489Z",
      "x_nadsec_last_seen": "2026-04-12T02:09:11.097Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ]
    },
    {
      "created": "2026-04-12T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--7a216e4b-4674-4392-adc4-b6c0cf587b2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.105.128.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T04:05:05.000Z",
      "valid_until": "2026-05-14T04:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T03:52:26.300Z",
      "x_nadsec_last_seen": "2026-04-12T03:52:56.300Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-12T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=314; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--e70c90d0-a9af-4d56-8241-d8323e299027",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.52.223.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T04:05:05.000Z",
      "valid_until": "2026-05-14T04:05:03.000Z",
      "x_nadsec_event_count": 3150,
      "x_nadsec_first_seen": "2026-04-11T14:39:25.267Z",
      "x_nadsec_last_seen": "2026-04-12T04:47:07.725Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-12T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--96b9f629-7936-4bec-8ecd-646fd48e2aa0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '220.246.79.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T04:05:05.000Z",
      "valid_until": "2026-05-14T04:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-12T03:46:19.418Z",
      "x_nadsec_last_seen": "2026-04-25T15:44:58.288Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-04-12T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--437e6367-1117-4588-8934-6abdaa4cbbba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T05:05:10.000Z",
      "valid_until": "2026-05-14T05:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-12T04:09:01.993Z",
      "x_nadsec_last_seen": "2026-04-22T08:22:45.788Z",
      "x_nadsec_ports": [
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-12T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--3f65e120-8a56-4310-8b2b-afde534359a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '211.20.144.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T05:05:10.000Z",
      "valid_until": "2026-05-14T05:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-12T04:54:02.705Z",
      "x_nadsec_last_seen": "2026-04-12T05:00:56.293Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-12T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--258c8ca5-1069-48d0-9b64-84944fd86533",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T05:05:10.000Z",
      "valid_until": "2026-05-14T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T04:14:42.689Z",
      "x_nadsec_last_seen": "2026-04-12T04:14:42.689Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-04-12T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--c1bfa54a-d1e4-4195-881a-3c025ad29b30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '58.34.237.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T05:05:10.000Z",
      "valid_until": "2026-05-14T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-12T04:54:52.620Z",
      "x_nadsec_last_seen": "2026-04-12T04:57:00.340Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-04-12T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0c5fe200-ab7e-4b78-ad1b-db8bb3c77b48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.183.90.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T05:05:10.000Z",
      "valid_until": "2026-05-14T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T04:32:31.306Z",
      "x_nadsec_last_seen": "2026-04-12T04:32:31.306Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-12T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=151734; asn_org=WEBYNE DATA CENTRE PRIVATE LIMITED",
      "id": "indicator--81e6c608-c640-4889-9b5b-971c1f84efee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.99.36.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T06:05:10.000Z",
      "valid_until": "2026-05-14T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T05:36:32.492Z",
      "x_nadsec_last_seen": "2026-04-12T05:36:32.658Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "151734"
      ],
      "x_nadsec_orgs": [
        "WEBYNE DATA CENTRE PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-04-12T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--330dca60-970d-4efa-8eb6-4a3c488b35c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.97.5.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T06:05:10.000Z",
      "valid_until": "2026-05-14T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T05:28:32.949Z",
      "x_nadsec_last_seen": "2026-04-12T05:28:32.949Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-12T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--420c4abe-37f1-4428-86c1-12fb791c55b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T06:05:10.000Z",
      "valid_until": "2026-05-14T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T05:15:20.531Z",
      "x_nadsec_last_seen": "2026-04-12T05:15:20.531Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-12T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--a2399ef8-50a3-4641-9606-a1ad4518d635",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T06:05:10.000Z",
      "valid_until": "2026-05-14T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T05:33:20.764Z",
      "x_nadsec_last_seen": "2026-04-12T05:33:20.764Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-12T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--4bc7f133-5c47-4438-bb48-61878ef2a320",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T06:05:10.000Z",
      "valid_until": "2026-05-14T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T05:33:31.020Z",
      "x_nadsec_last_seen": "2026-04-12T05:33:31.020Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-12T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--f4d5ee58-63e2-4dbe-8f46-b39f403dac62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '114.45.131.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T07:05:05.000Z",
      "valid_until": "2026-05-14T07:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-12T06:42:27.653Z",
      "x_nadsec_last_seen": "2026-04-12T06:44:33.715Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-12T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--81fc0919-081e-47ea-8e51-63e06f7e24f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.232.143.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T07:05:05.000Z",
      "valid_until": "2026-05-14T07:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T06:11:49.381Z",
      "x_nadsec_last_seen": "2026-04-12T06:11:49.381Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-12T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=PE; asn=18678; asn_org=INTERNEXA S.A. E.S.P",
      "id": "indicator--23bc2fc7-414a-4da5-ba20-c8631257a472",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.108.89.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T07:05:05.000Z",
      "valid_until": "2026-05-14T07:05:04.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-04-12T06:33:47.221Z",
      "x_nadsec_last_seen": "2026-04-12T06:38:07.547Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "18678"
      ],
      "x_nadsec_orgs": [
        "INTERNEXA S.A. E.S.P"
      ]
    },
    {
      "created": "2026-04-12T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31208; asn_org=PJSC MegaFon",
      "id": "indicator--8855f29c-44c9-4bde-b0ca-2a87fd457c6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.28.184.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T07:05:05.000Z",
      "valid_until": "2026-05-14T07:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-12T06:48:58.020Z",
      "x_nadsec_last_seen": "2026-04-12T06:54:28.700Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31208"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-04-12T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--6b66679e-3a5d-4b87-8db4-216e05d8957f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T07:05:05.000Z",
      "valid_until": "2026-05-14T07:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T06:11:29.067Z",
      "x_nadsec_last_seen": "2026-04-12T06:11:29.067Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-12T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--31fc53a2-c87f-405e-97ea-9b6941c22ce5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T07:05:05.000Z",
      "valid_until": "2026-05-14T07:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T06:11:28.715Z",
      "x_nadsec_last_seen": "2026-04-12T06:11:28.715Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-12T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--9224db4c-d574-4913-b162-02ad35f8f3b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T07:05:05.000Z",
      "valid_until": "2026-05-14T07:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T06:18:58.033Z",
      "x_nadsec_last_seen": "2026-04-12T06:18:58.033Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-12T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--796acbfa-3386-45b1-9d47-f3e000c56f24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T07:05:05.000Z",
      "valid_until": "2026-05-14T07:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T06:18:57.826Z",
      "x_nadsec_last_seen": "2026-04-12T06:18:57.826Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-12T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=52771; asn_org=GIGA BYTE TELECOMUNICACOES LTDA; user(top)=**",
      "id": "indicator--c7e4ad94-4ca6-4752-a05c-529579cc8a21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.186.44.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T09:05:11.000Z",
      "valid_until": "2026-05-14T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T08:58:51.199Z",
      "x_nadsec_last_seen": "2026-04-12T08:58:51.199Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52771"
      ],
      "x_nadsec_orgs": [
        "GIGA BYTE TELECOMUNICACOES LTDA"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-12T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=61; services=mysqld; ports=3306; cc=RU; asn=35278; asn_org=Sprinthost.ru LLC",
      "id": "indicator--b62ba837-c0c1-459d-af59-6f9f650a9fcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '193.222.62.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T09:05:11.000Z",
      "valid_until": "2026-05-14T09:05:09.000Z",
      "x_nadsec_event_count": 61,
      "x_nadsec_first_seen": "2026-04-12T08:30:07.805Z",
      "x_nadsec_last_seen": "2026-04-12T08:35:03.150Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "35278"
      ],
      "x_nadsec_orgs": [
        "Sprinthost.ru LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "***",
        "d*****v"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-12T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--f52d2951-93a4-4eb0-bb4c-95d0a6be183f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '49.49.196.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T09:05:11.000Z",
      "valid_until": "2026-05-14T09:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T08:43:40.561Z",
      "x_nadsec_last_seen": "2026-04-12T08:43:40.648Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-04-12T11:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=FR; asn=16276; asn_org=OVH SAS",
      "id": "indicator--4ac9876b-4783-44eb-ae14-684569406c2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T11:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '141.95.21.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T11:05:01.000Z",
      "valid_until": "2026-05-14T11:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T10:38:15.713Z",
      "x_nadsec_last_seen": "2026-04-12T10:38:15.764Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ]
    },
    {
      "created": "2026-04-12T11:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--71dedf79-e84e-41b3-b9dc-88545a44324f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T11:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '167.71.234.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T11:05:01.000Z",
      "valid_until": "2026-05-14T11:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T10:48:27.070Z",
      "x_nadsec_last_seen": "2026-04-12T10:48:27.070Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-12T11:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ES; asn=12334; asn_org=R Cable y Telecable Telecomunicaciones, S.A.U.",
      "id": "indicator--ab1f87f3-5960-480c-8035-aaa76b92292e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T11:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '213.60.255.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T11:05:01.000Z",
      "valid_until": "2026-05-14T11:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T10:06:15.684Z",
      "x_nadsec_last_seen": "2026-04-12T10:06:15.820Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "12334"
      ],
      "x_nadsec_orgs": [
        "R Cable y Telecable Telecomunicaciones, S.A.U."
      ]
    },
    {
      "created": "2026-04-12T11:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=NL; asn=201401; asn_org=NewVM B.V.",
      "id": "indicator--fd57f02e-a11e-4941-90f0-c9a9547b9cc4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T11:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '31.14.32.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T11:05:01.000Z",
      "valid_until": "2026-05-14T11:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T10:13:23.824Z",
      "x_nadsec_last_seen": "2026-04-12T10:13:23.824Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "201401"
      ],
      "x_nadsec_orgs": [
        "NewVM B.V."
      ]
    },
    {
      "created": "2026-04-12T11:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--a46859e4-48ed-4fbe-85b1-5253c483fe7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T11:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.52.186.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T11:05:01.000Z",
      "valid_until": "2026-05-14T11:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T10:33:45.210Z",
      "x_nadsec_last_seen": "2026-04-25T12:31:34.603Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-12T11:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--077052b5-b7b8-44a8-a15a-85153cf11193",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T11:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T11:05:01.000Z",
      "valid_until": "2026-05-14T11:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-12T10:08:22.913Z",
      "x_nadsec_last_seen": "2026-04-25T10:09:10.926Z",
      "x_nadsec_ports": [
        "445",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-12T11:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrord; ports=42; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--499ae404-85f4-4d11-ac9a-df7c1886df12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T11:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T11:05:01.000Z",
      "valid_until": "2026-05-14T11:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T10:10:54.868Z",
      "x_nadsec_last_seen": "2026-04-12T10:10:54.872Z",
      "x_nadsec_ports": [
        "42",
        "34339"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-12T11:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--72818ad5-cd2e-4078-abac-2d222614a1cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T11:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T11:05:01.000Z",
      "valid_until": "2026-05-14T11:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T10:22:41.822Z",
      "x_nadsec_last_seen": "2026-04-12T10:22:41.822Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-12T11:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--5d7d5e3d-032f-4227-9383-bba7a8308a44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T11:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T11:05:01.000Z",
      "valid_until": "2026-05-14T11:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T10:56:20.926Z",
      "x_nadsec_last_seen": "2026-04-12T10:56:20.926Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-12T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--6b159607-f629-4c32-aa4e-1ba968a950ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.161.52.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T12:05:11.000Z",
      "valid_until": "2026-05-14T12:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-12T11:14:28.157Z",
      "x_nadsec_last_seen": "2026-04-12T11:14:54.938Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-12T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--d5d95765-aef3-4cbf-8b74-d0705e247c67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.241.105.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T12:05:11.000Z",
      "valid_until": "2026-05-14T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-12T11:14:50.268Z",
      "x_nadsec_last_seen": "2026-04-12T11:18:08.224Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-04-12T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=40; services=httpd; ports=81; cc=US; asn=212238; asn_org=Datacamp Limited",
      "id": "indicator--eb09b5eb-2982-4117-ae4a-7a091b9f1305",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.198.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T12:05:11.000Z",
      "valid_until": "2026-05-14T12:05:09.000Z",
      "x_nadsec_event_count": 40,
      "x_nadsec_first_seen": "2026-04-12T11:26:30.766Z",
      "x_nadsec_last_seen": "2026-04-12T11:28:31.697Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ]
    },
    {
      "created": "2026-04-12T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c3e23f84-fd3f-4231-a28d-24f7434a0eea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '48.214.144.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T12:05:11.000Z",
      "valid_until": "2026-05-14T12:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-12T11:23:14.506Z",
      "x_nadsec_last_seen": "2026-04-17T07:45:51.141Z",
      "x_nadsec_ports": [
        "445",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-12T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--5094474f-8aed-47a1-96aa-65f310315e5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T12:05:11.000Z",
      "valid_until": "2026-05-14T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T11:31:16.043Z",
      "x_nadsec_last_seen": "2026-04-12T11:31:16.043Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-12T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--bf563fe5-008b-4152-bd3a-4043970c25ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T12:05:11.000Z",
      "valid_until": "2026-05-14T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T11:47:13.976Z",
      "x_nadsec_last_seen": "2026-04-12T11:47:13.976Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-12T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d7bd531a-b30b-42f5-a92f-a11ddf672660",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T12:05:11.000Z",
      "valid_until": "2026-05-14T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T11:47:04.167Z",
      "x_nadsec_last_seen": "2026-04-12T11:47:04.167Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-12T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--9fcf6ad4-ffbc-4c0c-a259-8af07f884eca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T13:05:11.000Z",
      "valid_until": "2026-05-14T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T12:08:03.934Z",
      "x_nadsec_last_seen": "2026-04-12T12:08:03.934Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-12T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=46; services=smbd; ports=445; cc=XK; asn=8661; asn_org=Telekomi i Kosoves SH.A.",
      "id": "indicator--900da427-cc9f-4b84-a76f-1f6ed0b9ac06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.175.59.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T13:05:11.000Z",
      "valid_until": "2026-05-14T13:05:09.000Z",
      "x_nadsec_event_count": 46,
      "x_nadsec_first_seen": "2026-04-12T12:34:40.113Z",
      "x_nadsec_last_seen": "2026-04-12T12:38:14.061Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "XK"
      ],
      "x_nadsec_asns": [
        "8661"
      ],
      "x_nadsec_orgs": [
        "Telekomi i Kosoves SH.A."
      ]
    },
    {
      "created": "2026-04-12T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--bf8d782e-2f58-4b2d-aeae-4b1c6f688524",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '188.18.52.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T13:05:11.000Z",
      "valid_until": "2026-05-14T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-12T12:48:55.962Z",
      "x_nadsec_last_seen": "2026-04-12T12:51:18.170Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-12T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=28573; asn_org=Claro NXT Telecomunicacoes Ltda",
      "id": "indicator--240d7019-5422-4325-93be-418eb8997273",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '191.185.21.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T13:05:11.000Z",
      "valid_until": "2026-05-14T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T12:52:59.901Z",
      "x_nadsec_last_seen": "2026-04-12T12:52:59.967Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28573"
      ],
      "x_nadsec_orgs": [
        "Claro NXT Telecomunicacoes Ltda"
      ]
    },
    {
      "created": "2026-04-12T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--3807ee3d-59a5-4618-bc67-e25a030f2ccd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '221.207.35.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T13:05:11.000Z",
      "valid_until": "2026-05-14T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T12:48:17.059Z",
      "x_nadsec_last_seen": "2026-04-12T12:48:17.059Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-04-12T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=FR; asn=51167; asn_org=Contabo GmbH",
      "id": "indicator--61350e94-4605-4e83-b4bd-daa23a064c42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '62.171.173.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T13:05:11.000Z",
      "valid_until": "2026-05-14T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T12:55:23.366Z",
      "x_nadsec_last_seen": "2026-04-12T12:55:23.652Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "51167"
      ],
      "x_nadsec_orgs": [
        "Contabo GmbH"
      ]
    },
    {
      "created": "2026-04-12T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=24955; asn_org=JSC Ufanet",
      "id": "indicator--481f4958-0469-476c-a72e-4ab3765ab85d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '77.79.134.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T13:05:11.000Z",
      "valid_until": "2026-05-14T13:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-12T12:58:13.607Z",
      "x_nadsec_last_seen": "2026-04-12T13:00:18.497Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "24955"
      ],
      "x_nadsec_orgs": [
        "JSC Ufanet"
      ]
    },
    {
      "created": "2026-04-12T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=25513; asn_org=PJSC Moscow city telephone network",
      "id": "indicator--254cd2b8-6af8-4ef1-8e3e-561e26f4f9f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.29.126.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T13:05:11.000Z",
      "valid_until": "2026-05-14T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-12T12:31:43.548Z",
      "x_nadsec_last_seen": "2026-04-12T12:33:50.305Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25513"
      ],
      "x_nadsec_orgs": [
        "PJSC Moscow city telephone network"
      ]
    },
    {
      "created": "2026-04-12T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=136119; asn_org=PT Bali Towerindo Sentra, Tbk",
      "id": "indicator--db21abdf-efaa-419f-8cf3-7e4d63243d43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.138.40.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T14:05:10.000Z",
      "valid_until": "2026-05-14T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-12T13:43:25.782Z",
      "x_nadsec_last_seen": "2026-04-12T13:45:29.981Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "136119"
      ],
      "x_nadsec_orgs": [
        "PT Bali Towerindo Sentra, Tbk"
      ]
    },
    {
      "created": "2026-04-12T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--fd7ff019-5078-42fd-af31-52aa21fbad2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.163.15.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T14:05:10.000Z",
      "valid_until": "2026-05-14T14:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T13:11:08.509Z",
      "x_nadsec_last_seen": "2026-04-12T13:11:18.650Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-12T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=8402; asn_org=PVimpelCom",
      "id": "indicator--037dc04c-fdf7-4ea8-a874-18464bcd10d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '89.179.241.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T14:05:10.000Z",
      "valid_until": "2026-05-14T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-12T13:44:18.955Z",
      "x_nadsec_last_seen": "2026-04-27T10:13:20.811Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8402"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-04-12T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--28d2ccca-7765-4b2e-9e3b-e4b964caf68a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.119.75.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T15:05:11.000Z",
      "valid_until": "2026-05-14T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T14:38:03.721Z",
      "x_nadsec_last_seen": "2026-04-12T14:38:04.139Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-12T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=ZA; asn=36994; asn_org=Vodacom-VB",
      "id": "indicator--bae20017-7045-4123-87e9-8191b95933cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.24.238.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T15:05:11.000Z",
      "valid_until": "2026-05-14T15:05:09.000Z",
      "x_nadsec_event_count": 45,
      "x_nadsec_first_seen": "2026-04-12T14:35:51.031Z",
      "x_nadsec_last_seen": "2026-04-12T14:38:25.182Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "36994"
      ],
      "x_nadsec_orgs": [
        "Vodacom-VB"
      ]
    },
    {
      "created": "2026-04-12T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--e080192e-88f7-4026-b7b2-dde901307c67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T15:05:11.000Z",
      "valid_until": "2026-05-14T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T02:43:44.181Z",
      "x_nadsec_last_seen": "2026-04-12T14:23:47.734Z",
      "x_nadsec_ports": [
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-12T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--c54c77e2-1890-4422-bcfc-5135be5b17f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T15:05:11.000Z",
      "valid_until": "2026-05-14T15:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-01T06:23:46.238Z",
      "x_nadsec_last_seen": "2026-04-29T12:36:16.537Z",
      "x_nadsec_ports": [
        "135",
        "445",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "smbd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-12T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=138746; asn_org=Live Fibernet",
      "id": "indicator--75c410b8-ffce-44b0-8bbb-56992b4474d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.125.155.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T16:05:11.000Z",
      "valid_until": "2026-05-14T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T15:15:43.684Z",
      "x_nadsec_last_seen": "2026-04-12T15:15:43.716Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "138746"
      ],
      "x_nadsec_orgs": [
        "Live Fibernet"
      ]
    },
    {
      "created": "2026-04-12T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PE; asn=27843; asn_org=WIN EMPRESAS S.A.C.",
      "id": "indicator--9bdb4de3-243b-47c3-b1f3-19e517eb795b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '168.121.221.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T16:05:11.000Z",
      "valid_until": "2026-05-14T16:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-12T15:59:17.312Z",
      "x_nadsec_last_seen": "2026-04-12T15:59:59.273Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "27843"
      ],
      "x_nadsec_orgs": [
        "WIN EMPRESAS S.A.C."
      ]
    },
    {
      "created": "2026-04-12T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--dbc1c241-cb58-443f-8354-d1eb2a3cc745",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.176.186.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T16:05:11.000Z",
      "valid_until": "2026-05-14T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-12T15:09:33.574Z",
      "x_nadsec_last_seen": "2026-04-14T00:58:50.489Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-04-12T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--6bdaf050-ed5b-4f71-8533-257d926f054f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.124.175.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T16:05:11.000Z",
      "valid_until": "2026-05-14T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T15:23:57.298Z",
      "x_nadsec_last_seen": "2026-04-12T15:24:07.458Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-12T17:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--be887831-a07d-4838-8acd-1f18fa4e7f17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T17:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.41.30.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T17:05:19.000Z",
      "valid_until": "2026-05-14T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-12T16:49:07.027Z",
      "x_nadsec_last_seen": "2026-04-12T16:51:13.616Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-04-12T17:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--561a7ccd-d1b6-42e9-a277-3c49596a02b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T17:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T17:05:19.000Z",
      "valid_until": "2026-05-14T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T17:00:05.121Z",
      "x_nadsec_last_seen": "2026-04-12T17:00:05.121Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-12T17:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--836055fb-a07f-4d63-83fa-3e8d255b3823",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T17:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T17:05:19.000Z",
      "valid_until": "2026-05-14T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T16:42:35.941Z",
      "x_nadsec_last_seen": "2026-04-12T16:42:35.941Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-12T17:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--8196bd27-8ebb-426a-a044-ab1d192ea13b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T17:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T17:05:19.000Z",
      "valid_until": "2026-05-14T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T16:25:51.167Z",
      "x_nadsec_last_seen": "2026-04-12T16:25:51.167Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-12T17:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=17139; asn_org=Corporate Colocation Inc.",
      "id": "indicator--4949010d-7b5f-4c3a-80e5-56c2d3f010a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T17:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.64.170.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T17:05:19.000Z",
      "valid_until": "2026-05-14T17:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T16:21:45.353Z",
      "x_nadsec_last_seen": "2026-04-12T16:21:45.483Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "17139"
      ],
      "x_nadsec_orgs": [
        "Corporate Colocation Inc."
      ]
    },
    {
      "created": "2026-04-12T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=HK; asn=55933; asn_org=Cloudie Limited; user(top)=**",
      "id": "indicator--a0626861-1324-494e-a59f-d076470ccf59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.115.50.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T18:05:10.000Z",
      "valid_until": "2026-05-14T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T17:19:38.626Z",
      "x_nadsec_last_seen": "2026-04-17T19:27:56.042Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "55933"
      ],
      "x_nadsec_orgs": [
        "Cloudie Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-12T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--5182a074-8d08-41e3-9508-bddc0dcb102b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.91.147.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T18:05:10.000Z",
      "valid_until": "2026-05-14T18:05:09.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-04-12T17:40:46.593Z",
      "x_nadsec_last_seen": "2026-04-12T17:43:28.078Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-12T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--4dd7e0e4-b15e-4fc3-ad15-b4f2c33e96d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '116.172.249.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T18:05:10.000Z",
      "valid_until": "2026-05-14T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T17:36:01.515Z",
      "x_nadsec_last_seen": "2026-04-12T17:36:01.515Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-04-12T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--9ba9737f-816b-4dbd-84ad-b88e03a357b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T18:05:10.000Z",
      "valid_until": "2026-05-14T18:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-12T17:50:10.763Z",
      "x_nadsec_last_seen": "2026-04-18T11:34:43.138Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-12T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=KR; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--a0bda11d-e696-448c-91a8-8850613727ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '101.36.114.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T19:05:11.000Z",
      "valid_until": "2026-05-14T19:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-12T18:54:17.252Z",
      "x_nadsec_last_seen": "2026-04-12T18:54:38.487Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-12T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--196ab323-794b-4d1f-b357-e71ddd31b9f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.194.250.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T19:05:11.000Z",
      "valid_until": "2026-05-14T19:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-12T18:46:03.361Z",
      "x_nadsec_last_seen": "2026-04-12T18:46:31.957Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-12T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=48092; asn_org=T2 Mobile LLC",
      "id": "indicator--13e9b9cc-b00c-4bcd-9712-7b81c2367b52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.59.106.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T19:05:11.000Z",
      "valid_until": "2026-05-14T19:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T18:54:39.451Z",
      "x_nadsec_last_seen": "2026-04-12T18:54:39.451Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48092"
      ],
      "x_nadsec_orgs": [
        "T2 Mobile LLC"
      ]
    },
    {
      "created": "2026-04-12T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=58895; asn_org=Ebone Network PVT. Limited",
      "id": "indicator--b7cc3ff5-2b46-448d-a30f-9943c37ca543",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '43.231.62.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T19:05:11.000Z",
      "valid_until": "2026-05-14T19:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-12T18:28:00.153Z",
      "x_nadsec_last_seen": "2026-04-12T18:28:06.213Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "58895"
      ],
      "x_nadsec_orgs": [
        "Ebone Network PVT. Limited"
      ]
    },
    {
      "created": "2026-04-12T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=131293; asn_org=TOT Public Company Limited",
      "id": "indicator--b660c43e-d0eb-4b8b-93ac-51c11219a78b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.179.130.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T20:05:11.000Z",
      "valid_until": "2026-05-14T20:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-12T19:05:17.228Z",
      "x_nadsec_last_seen": "2026-04-12T19:11:44.866Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131293"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-04-12T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--0e5125a2-fb77-45bd-b5c3-f14ee16322c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T20:05:11.000Z",
      "valid_until": "2026-05-14T20:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-12T19:10:00.244Z",
      "x_nadsec_last_seen": "2026-04-25T17:28:48.591Z",
      "x_nadsec_ports": [
        "1433",
        "1883",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mqttd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-12T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--195c265c-ba6e-4c4c-b5a7-e4cb4e62e2a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T20:05:11.000Z",
      "valid_until": "2026-05-14T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T19:28:36.377Z",
      "x_nadsec_last_seen": "2026-04-23T17:27:45.446Z",
      "x_nadsec_ports": [
        "135",
        "1433"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-12T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--932d5913-a980-475b-926c-e104684c45e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T20:05:11.000Z",
      "valid_until": "2026-05-14T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T19:49:17.364Z",
      "x_nadsec_last_seen": "2026-04-12T19:49:27.683Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-12T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c5919236-d97c-45b3-ae42-4f52ae483551",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.124.175.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T20:05:11.000Z",
      "valid_until": "2026-05-14T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T19:13:50.070Z",
      "x_nadsec_last_seen": "2026-04-12T19:14:00.229Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-12T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=RO; asn=47890; asn_org=Unmanaged Ltd",
      "id": "indicator--d8754914-e8dd-4922-9c02-c966adac1ea9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '80.94.92.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T20:05:11.000Z",
      "valid_until": "2026-05-14T20:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-04-12T19:37:32.377Z",
      "x_nadsec_last_seen": "2026-04-13T00:16:09.176Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "81",
        "135",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper",
        "ftpd",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "RO"
      ],
      "x_nadsec_asns": [
        "47890"
      ],
      "x_nadsec_orgs": [
        "Unmanaged Ltd"
      ]
    },
    {
      "created": "2026-04-12T21:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PK; asn=151333; asn_org=ASCON TEL PRIVATE LIMITED; user(top)=**",
      "id": "indicator--a5344634-59a8-459d-8ccb-91366284c29d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T21:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.199.141.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T21:05:11.000Z",
      "valid_until": "2026-05-14T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T20:17:42.179Z",
      "x_nadsec_last_seen": "2026-04-22T03:59:58.940Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "151333"
      ],
      "x_nadsec_orgs": [
        "ASCON TEL PRIVATE LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-12T21:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--30ed341e-8dd7-4abb-af1b-fdce3b5b0636",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T21:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T21:05:11.000Z",
      "valid_until": "2026-05-14T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T20:46:58.774Z",
      "x_nadsec_last_seen": "2026-04-12T20:46:58.774Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-12T21:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--396c35c8-2794-4887-b1d3-a86b8523f076",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T21:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.163.32.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T21:05:11.000Z",
      "valid_until": "2026-05-14T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T20:32:25.480Z",
      "x_nadsec_last_seen": "2026-04-12T20:32:25.480Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-12T22:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--4490c661-1290-47e5-aa85-0cc072fc1e34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T22:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '114.37.156.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T22:05:20.000Z",
      "valid_until": "2026-05-14T22:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-12T21:57:21.954Z",
      "x_nadsec_last_seen": "2026-04-12T22:03:46.548Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-12T22:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--5d12149e-8147-4b24-80d7-1d9c0be6f1d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T22:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '134.199.213.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T22:05:20.000Z",
      "valid_until": "2026-05-14T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T21:48:43.068Z",
      "x_nadsec_last_seen": "2026-04-12T21:48:46.206Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-12T22:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=RU; asn=12768; asn_org=JSC ER-Telecom Holding; user(top)=**",
      "id": "indicator--95d29599-5886-42ff-82d3-249dbde19bee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T22:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.146.234.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T22:05:20.000Z",
      "valid_until": "2026-05-14T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T21:46:35.750Z",
      "x_nadsec_last_seen": "2026-04-12T21:46:35.750Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12768"
      ],
      "x_nadsec_orgs": [
        "JSC ER-Telecom Holding"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-12T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--b21fd1b0-8ac3-4c72-b228-d52c7e8d58e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.236.127.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T23:05:10.000Z",
      "valid_until": "2026-05-14T23:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T22:25:44.274Z",
      "x_nadsec_last_seen": "2026-04-12T22:26:14.274Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-12T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--667de3fe-8edd-4e56-a6f6-fada9fffb200",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.202.110.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T23:05:10.000Z",
      "valid_until": "2026-05-14T23:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T22:20:58.489Z",
      "x_nadsec_last_seen": "2026-04-12T22:20:58.496Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-12T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c6737dee-e112-4c44-b89a-2eaf26037a55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.124.117.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T23:05:10.000Z",
      "valid_until": "2026-05-14T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-12T22:39:45.052Z",
      "x_nadsec_last_seen": "2026-04-12T22:39:45.052Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-12T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=httpd; ports=81; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--5d711ad2-d6aa-49c6-affa-8bc4e3a11505",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T23:05:10.000Z",
      "valid_until": "2026-05-14T23:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-04-12T22:25:42.491Z",
      "x_nadsec_last_seen": "2026-04-16T10:30:25.788Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-12T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--0cc7a57d-8749-4467-ae1d-d80525db8368",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T23:05:10.000Z",
      "valid_until": "2026-05-14T23:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-12T22:41:19.727Z",
      "x_nadsec_last_seen": "2026-04-16T10:40:26.767Z",
      "x_nadsec_ports": [
        "81",
        "135"
      ],
      "x_nadsec_services": [
        "httpd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-12T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=16637; asn_org=MTN Business Solutions",
      "id": "indicator--ec28ee9f-03d2-4c06-9a7e-82d05e381f1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.8.6.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T23:05:10.000Z",
      "valid_until": "2026-05-14T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-12T22:15:01.173Z",
      "x_nadsec_last_seen": "2026-04-12T22:17:08.766Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "16637"
      ],
      "x_nadsec_orgs": [
        "MTN Business Solutions"
      ]
    },
    {
      "created": "2026-04-13T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=40193; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3fd44e11-6bab-4835-a15e-ca53f7623448",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T00:05:11.000Z",
      "valid_until": "2026-05-15T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T23:24:20.268Z",
      "x_nadsec_last_seen": "2026-04-12T23:24:20.271Z",
      "x_nadsec_ports": [
        "42",
        "40193"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-13T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--69ce3a85-0995-434b-872b-53604bf51959",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '54.227.93.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T01:05:03.000Z",
      "valid_until": "2026-05-15T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T00:56:35.173Z",
      "x_nadsec_last_seen": "2026-04-13T00:56:35.173Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-13T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--8fb2cda6-4231-4f22-9a82-9ce9e5b57d24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '125.167.123.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T02:05:10.000Z",
      "valid_until": "2026-05-15T02:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-13T01:11:19.079Z",
      "x_nadsec_last_seen": "2026-04-13T01:15:49.395Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-13T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=16276; asn_org=OVH SAS; user(top)=**",
      "id": "indicator--cde53982-e31e-4cad-bba1-e71b24a2a744",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.32.238.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T02:05:10.000Z",
      "valid_until": "2026-05-15T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T01:35:06.285Z",
      "x_nadsec_last_seen": "2026-04-13T01:35:06.285Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-13T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--161fb842-bc55-4eac-8d31-cc06e2431993",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.189.240.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T02:05:10.000Z",
      "valid_until": "2026-05-15T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T01:44:11.194Z",
      "x_nadsec_last_seen": "2026-04-13T01:44:11.194Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-13T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--f86a49d7-b78e-48b7-a5c7-84f330fdc755",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.82.36.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T02:05:10.000Z",
      "valid_until": "2026-05-15T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-13T01:17:08.060Z",
      "x_nadsec_last_seen": "2026-04-13T01:19:13.552Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-13T03:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC; user(top)=**",
      "id": "indicator--d6865873-9779-40ee-ab5d-b50debb91472",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T03:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.121.238.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T03:05:04.000Z",
      "valid_until": "2026-05-15T03:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T02:31:08.287Z",
      "x_nadsec_last_seen": "2026-04-13T02:31:08.287Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-13T03:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--68ebda31-294a-4189-a0e4-4a32f4e72040",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T03:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.240.236.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T03:05:04.000Z",
      "valid_until": "2026-05-15T03:05:00.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-04-01T22:58:43.221Z",
      "x_nadsec_last_seen": "2026-04-30T10:22:31.636Z",
      "x_nadsec_ports": [
        "3306",
        "445",
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd",
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-04-13T03:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mssqld; ports=1433; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--91a06d74-53c2-4ed8-96f9-c54cae6c63b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T03:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '8.219.222.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T03:05:04.000Z",
      "valid_until": "2026-05-15T03:05:00.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-04-13T02:28:08.044Z",
      "x_nadsec_last_seen": "2026-04-29T13:12:27.027Z",
      "x_nadsec_ports": [
        "27017",
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "mongod",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-13T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=epmapper; ports=135; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--2938bc43-f893-4b4f-8b91-8a7f0971ea7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.97.26.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T05:05:10.000Z",
      "valid_until": "2026-05-15T05:05:08.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-13T04:13:56.234Z",
      "x_nadsec_last_seen": "2026-04-13T04:14:32.255Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-13T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--175ef817-efaf-4648-9b1d-910a32ea2b7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T05:05:10.000Z",
      "valid_until": "2026-05-15T05:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-13T04:37:34.410Z",
      "x_nadsec_last_seen": "2026-04-13T04:37:35.534Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-13T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--edc05f00-7ea1-4146-955c-1d93f65eb68a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T05:05:10.000Z",
      "valid_until": "2026-05-15T05:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-13T04:38:08.131Z",
      "x_nadsec_last_seen": "2026-04-26T15:31:29.045Z",
      "x_nadsec_ports": [
        "27017",
        "135",
        "1433"
      ],
      "x_nadsec_services": [
        "mongod",
        "epmapper",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-13T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1045; services=smbd; ports=445; cc=RU; asn=44270; asn_org=TC TOR LLC",
      "id": "indicator--bb86829c-4372-464a-b5ec-254c0e462c18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.173.126.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T05:05:10.000Z",
      "valid_until": "2026-05-15T05:05:08.000Z",
      "x_nadsec_event_count": 3111,
      "x_nadsec_first_seen": "2026-04-13T04:44:12.586Z",
      "x_nadsec_last_seen": "2026-04-13T05:39:27.573Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "44270"
      ],
      "x_nadsec_orgs": [
        "TC TOR LLC"
      ]
    },
    {
      "created": "2026-04-13T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MA; asn=36903; asn_org=MT-MPLS; user(top)=**",
      "id": "indicator--b8ce3f78-d5ec-4fd6-a810-37857bf38a3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '105.154.79.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T06:05:05.000Z",
      "valid_until": "2026-05-15T06:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T05:33:39.898Z",
      "x_nadsec_last_seen": "2026-04-13T05:33:39.898Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "36903"
      ],
      "x_nadsec_orgs": [
        "MT-MPLS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-13T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--13b4d9c9-b5af-403e-9d18-7ff28081ba0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '60.190.209.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T06:05:05.000Z",
      "valid_until": "2026-05-15T06:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T06:00:43.516Z",
      "x_nadsec_last_seen": "2026-04-13T06:00:43.516Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-13T07:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--ed61e014-0673-479f-afcf-6fd1bf1009fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T07:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.232.58.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T07:05:20.000Z",
      "valid_until": "2026-05-15T07:05:18.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-13T06:56:48.240Z",
      "x_nadsec_last_seen": "2026-04-13T06:58:52.235Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-13T07:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--9f8bdb2a-ab8f-4db6-b3b5-908beadc0435",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T07:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.232.89.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T07:05:20.000Z",
      "valid_until": "2026-05-15T07:05:18.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-13T06:52:28.809Z",
      "x_nadsec_last_seen": "2026-04-13T06:58:53.015Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-13T07:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--146fdb43-aafa-48ba-921a-df3ad57c9219",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T07:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T07:05:20.000Z",
      "valid_until": "2026-05-15T07:05:18.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-13T06:55:49.851Z",
      "x_nadsec_last_seen": "2026-04-20T21:52:15.503Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-13T07:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--7653c9a3-06c9-46eb-af90-b2c704d59e7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T07:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.250.135.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T07:05:20.000Z",
      "valid_until": "2026-05-15T07:05:18.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T06:44:46.407Z",
      "x_nadsec_last_seen": "2026-04-13T06:44:46.407Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-13T07:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--f0dc03fb-1b23-4966-9013-b967f8d1b984",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T07:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T07:05:20.000Z",
      "valid_until": "2026-05-15T07:05:18.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T06:55:57.947Z",
      "x_nadsec_last_seen": "2026-04-13T06:55:57.947Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-13T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--87a81c85-ec82-4e12-b800-617430692305",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '125.167.176.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T08:05:10.000Z",
      "valid_until": "2026-05-15T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-13T07:13:18.924Z",
      "x_nadsec_last_seen": "2026-04-13T07:13:25.480Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-13T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MX; asn=8151; asn_org=UNINET; user(top)=**",
      "id": "indicator--2c801bee-5245-4337-8190-36fe5766fbe6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '187.137.204.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T08:05:10.000Z",
      "valid_until": "2026-05-15T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T07:43:01.984Z",
      "x_nadsec_last_seen": "2026-04-13T07:43:01.984Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-13T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--76560132-d912-48f2-9a94-d08a374fc5e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T08:05:10.000Z",
      "valid_until": "2026-05-15T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T07:17:44.492Z",
      "x_nadsec_last_seen": "2026-04-13T07:17:44.492Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-13T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--51a2d6d0-d42a-458e-a074-1077257fe650",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.192.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T08:05:10.000Z",
      "valid_until": "2026-05-15T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T07:40:50.792Z",
      "x_nadsec_last_seen": "2026-04-13T07:40:50.792Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-13T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=IN; asn=17488; asn_org=Hathway IP Over Cable Internet; user(top)=**",
      "id": "indicator--6f81ab7a-8b30-4823-9f4a-61bfcc0144b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '202.88.222.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T08:05:10.000Z",
      "valid_until": "2026-05-15T08:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-13T07:08:41.420Z",
      "x_nadsec_last_seen": "2026-04-29T06:50:48.124Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17488"
      ],
      "x_nadsec_orgs": [
        "Hathway IP Over Cable Internet"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-13T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--7934b6c9-1b9c-4ab9-9bef-ce89d93c003c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '100.51.6.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T09:05:05.000Z",
      "valid_until": "2026-05-15T09:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T08:12:47.072Z",
      "x_nadsec_last_seen": "2026-04-13T08:12:47.072Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-13T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--8dabf845-53f3-46d5-919f-ede9202c8113",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '124.31.20.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T09:05:05.000Z",
      "valid_until": "2026-05-15T09:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T08:59:14.168Z",
      "x_nadsec_last_seen": "2026-04-13T08:59:14.168Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-13T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AU; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--31c2cabd-a662-4d84-b230-9374a293f3d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '170.64.184.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T09:05:05.000Z",
      "valid_until": "2026-05-15T09:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-13T09:04:32.196Z",
      "x_nadsec_last_seen": "2026-04-13T09:04:32.262Z",
      "x_nadsec_ports": [
        "445",
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-13T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--fe33ed51-d2cf-4843-952c-94022aa674e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '58.186.8.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T09:05:05.000Z",
      "valid_until": "2026-05-15T09:05:04.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-13T08:39:18.256Z",
      "x_nadsec_last_seen": "2026-04-13T18:27:42.874Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-04-13T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--1d67b9a7-db26-4b1c-a619-1eb910f4168f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T09:05:05.000Z",
      "valid_until": "2026-05-15T09:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T08:25:03.066Z",
      "x_nadsec_last_seen": "2026-04-13T08:25:03.066Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-13T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--a73cf790-bfa3-422c-8487-75bbbfa8b027",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T09:05:05.000Z",
      "valid_until": "2026-05-15T09:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T08:30:08.353Z",
      "x_nadsec_last_seen": "2026-04-13T08:30:08.353Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-13T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=33353; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--4c211673-4566-4ba3-bd53-3cffd509a6a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T09:05:05.000Z",
      "valid_until": "2026-05-15T09:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-13T08:24:41.530Z",
      "x_nadsec_last_seen": "2026-04-13T08:24:41.533Z",
      "x_nadsec_ports": [
        "42",
        "33353"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-13T10:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1940; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--5b338044-a537-4aca-a661-441875420117",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T10:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.161.227.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T10:05:15.000Z",
      "valid_until": "2026-05-15T10:05:09.000Z",
      "x_nadsec_event_count": 3149,
      "x_nadsec_first_seen": "2026-04-13T09:35:51.869Z",
      "x_nadsec_last_seen": "2026-04-13T10:21:41.436Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-13T10:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PS; asn=12975; asn_org=Palestine Telecommunications Company (PALTEL)",
      "id": "indicator--54756f7f-6adf-49bc-b930-462f6f09440d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T10:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '212.14.247.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T10:05:15.000Z",
      "valid_until": "2026-05-15T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-13T09:37:05.709Z",
      "x_nadsec_last_seen": "2026-04-13T09:37:05.763Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PS"
      ],
      "x_nadsec_asns": [
        "12975"
      ],
      "x_nadsec_orgs": [
        "Palestine Telecommunications Company (PALTEL)"
      ]
    },
    {
      "created": "2026-04-13T10:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=BG; asn=213438; asn_org=ColocaTel Inc.; user(top)=r**t",
      "id": "indicator--c3bd2a7c-2ab6-47ef-a34b-64af76c1ee03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T10:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.11.167.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T10:05:15.000Z",
      "valid_until": "2026-05-15T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-13T09:06:18.778Z",
      "x_nadsec_last_seen": "2026-04-13T09:06:23.856Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "213438"
      ],
      "x_nadsec_orgs": [
        "ColocaTel Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        "",
        "s****3"
      ]
    },
    {
      "created": "2026-04-13T10:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--e37161da-a02b-4dc5-a21a-8afc0db910bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T10:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '88.253.61.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T10:05:15.000Z",
      "valid_until": "2026-05-15T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-13T09:59:23.139Z",
      "x_nadsec_last_seen": "2026-04-13T09:59:23.194Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-13T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--20066a56-ced1-48c3-80b3-8e792dad8819",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '122.187.50.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T11:05:10.000Z",
      "valid_until": "2026-05-15T11:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-13T10:07:41.982Z",
      "x_nadsec_last_seen": "2026-04-13T10:09:47.081Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-04-13T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mongod; ports=27017; cc=KR; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--1ef48b62-787b-402f-b1a4-0182002d746e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.243.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T11:05:10.000Z",
      "valid_until": "2026-05-15T11:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-13T10:26:44.005Z",
      "x_nadsec_last_seen": "2026-04-30T17:58:23.587Z",
      "x_nadsec_ports": [
        "27017",
        "1723"
      ],
      "x_nadsec_services": [
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-13T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--bd3d8cb6-8ae7-479c-906a-88e42919091c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T11:05:10.000Z",
      "valid_until": "2026-05-15T11:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T10:36:15.648Z",
      "x_nadsec_last_seen": "2026-04-13T10:36:15.648Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-13T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--2d68e7fc-4ff7-4107-a49f-e9eeabebb747",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '81.10.30.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T11:05:10.000Z",
      "valid_until": "2026-05-15T11:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-13T10:25:54.504Z",
      "x_nadsec_last_seen": "2026-04-13T10:25:54.569Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-13T13:07:00.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--a6e76ae2-e142-46f1-bc72-6246c189cfa1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T13:07:00.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.191.32.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T13:07:00.000Z",
      "valid_until": "2026-05-15T13:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-13T12:32:42.428Z",
      "x_nadsec_last_seen": "2026-04-13T12:34:46.452Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-13T13:07:00.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=34; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f49b9ed3-98d7-4ad7-a5a0-7fb552a5ce25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T13:07:00.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.190.74.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T13:07:00.000Z",
      "valid_until": "2026-05-15T13:05:00.000Z",
      "x_nadsec_event_count": 34,
      "x_nadsec_first_seen": "2026-04-13T12:34:01.621Z",
      "x_nadsec_last_seen": "2026-04-13T12:35:00.954Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-13T13:07:00.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--ad2d22c0-f00b-42f2-873b-7fd390568130",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T13:07:00.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.22.6.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T13:07:00.000Z",
      "valid_until": "2026-05-15T13:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T12:33:31.008Z",
      "x_nadsec_last_seen": "2026-04-13T12:33:31.008Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-13T13:07:00.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--642aeb08-45f0-4d66-9fa1-5ebeec21af99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T13:07:00.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.168.6.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T13:07:00.000Z",
      "valid_until": "2026-05-15T13:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T12:33:02.187Z",
      "x_nadsec_last_seen": "2026-04-13T12:33:02.187Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-13T13:07:00.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--0cdd89cf-2cf2-4330-8f01-b9ba82005e37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T13:07:00.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '39.38.251.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T13:07:00.000Z",
      "valid_until": "2026-05-15T13:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-13T12:49:41.422Z",
      "x_nadsec_last_seen": "2026-04-13T12:54:29.101Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-04-13T13:07:00.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BG; asn=8717; asn_org=A1 Bulgaria EAD",
      "id": "indicator--eada2a4f-a9b0-4d6f-987d-12fc1e1c999e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T13:07:00.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '84.242.142.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T13:07:00.000Z",
      "valid_until": "2026-05-15T13:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-13T12:47:05.179Z",
      "x_nadsec_last_seen": "2026-04-13T12:47:06.653Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "8717"
      ],
      "x_nadsec_orgs": [
        "A1 Bulgaria EAD"
      ]
    },
    {
      "created": "2026-04-13T14:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--09510db1-445a-4e4d-86e9-6e79f245fed5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T14:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.88.110.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T14:05:04.000Z",
      "valid_until": "2026-05-15T14:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-13T13:59:09.955Z",
      "x_nadsec_last_seen": "2026-04-13T14:01:17.430Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-04-13T14:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--36ea318c-b5b0-4591-afa7-b8137578f014",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T14:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '116.97.106.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T14:05:04.000Z",
      "valid_until": "2026-05-15T14:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-13T13:56:03.263Z",
      "x_nadsec_last_seen": "2026-04-13T13:58:08.344Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-13T14:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=34; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--dbaa7b5e-50b0-4ad7-8719-f389a9bc63cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T14:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.22.138.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T14:05:04.000Z",
      "valid_until": "2026-05-15T14:05:03.000Z",
      "x_nadsec_event_count": 34,
      "x_nadsec_first_seen": "2026-04-13T13:20:46.768Z",
      "x_nadsec_last_seen": "2026-04-13T13:21:43.390Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-13T14:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=UA; asn=44019; asn_org=Spetsnet LLC",
      "id": "indicator--de0bc393-77af-4739-931f-649d42f35798",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T14:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '31.128.178.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T14:05:04.000Z",
      "valid_until": "2026-05-15T14:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T13:52:01.990Z",
      "x_nadsec_last_seen": "2026-04-13T13:52:01.990Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "44019"
      ],
      "x_nadsec_orgs": [
        "Spetsnet LLC"
      ]
    },
    {
      "created": "2026-04-13T14:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--e6f68e27-019f-4ffa-8e66-482f8d40f675",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T14:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.187.111.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T14:05:04.000Z",
      "valid_until": "2026-05-15T14:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T13:37:45.706Z",
      "x_nadsec_last_seen": "2026-04-13T13:37:45.706Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-13T14:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8624f336-5f5d-49b0-af1b-5d957ac03a4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T14:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T14:05:04.000Z",
      "valid_until": "2026-05-15T14:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-13T13:39:29.829Z",
      "x_nadsec_last_seen": "2026-04-21T03:30:56.844Z",
      "x_nadsec_ports": [
        "21",
        "1883"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-13T14:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--1dbda11c-a764-487e-88df-980ac98e1955",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T14:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.183.135.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T14:05:04.000Z",
      "valid_until": "2026-05-15T14:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T13:16:21.739Z",
      "x_nadsec_last_seen": "2026-04-13T13:16:21.739Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-13T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=56272; asn_org=Pulse Telesystems Pvt Ltd",
      "id": "indicator--fae62f13-087c-4606-871d-e2af03aa87cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.249.204.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T15:05:10.000Z",
      "valid_until": "2026-05-15T15:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-13T14:50:32.085Z",
      "x_nadsec_last_seen": "2026-04-27T14:49:49.949Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "56272"
      ],
      "x_nadsec_orgs": [
        "Pulse Telesystems Pvt Ltd"
      ]
    },
    {
      "created": "2026-04-13T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--38971095-3b51-4c99-bf05-5036f1c7160e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T15:05:10.000Z",
      "valid_until": "2026-05-15T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T15:03:31.812Z",
      "x_nadsec_last_seen": "2026-04-13T15:03:31.812Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-13T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=IT; asn=3269; asn_org=TIM; user(top)=**",
      "id": "indicator--f400af7f-72aa-4946-a704-e8443a9a80eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.7.192.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T15:05:10.000Z",
      "valid_until": "2026-05-15T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-13T14:21:01.224Z",
      "x_nadsec_last_seen": "2026-04-13T14:21:02.656Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "3269"
      ],
      "x_nadsec_orgs": [
        "TIM"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-13T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--fc47a77c-4ad2-4e6b-9a5f-85b3f5f137f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.96.177.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T15:05:10.000Z",
      "valid_until": "2026-05-15T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-13T14:21:02.809Z",
      "x_nadsec_last_seen": "2026-04-13T14:23:09.423Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-13T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--574318c1-39c6-45e7-8fbb-6007d0dd6239",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T16:05:10.000Z",
      "valid_until": "2026-05-15T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-13T16:00:06.195Z",
      "x_nadsec_last_seen": "2026-04-13T16:00:39.142Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-13T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--b6400d11-625e-4761-a8f8-2d5e9422d107",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.38.16.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T16:05:10.000Z",
      "valid_until": "2026-05-15T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-13T16:03:36.884Z",
      "x_nadsec_last_seen": "2026-04-13T16:05:43.381Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-13T17:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--1382196a-7067-45e5-b310-0c213a9fc79f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T17:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T17:05:32.000Z",
      "valid_until": "2026-05-15T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T16:20:25.948Z",
      "x_nadsec_last_seen": "2026-04-13T16:20:25.948Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-13T17:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--e533cbc5-eeea-4102-979a-070de9d5779b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T17:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T17:05:32.000Z",
      "valid_until": "2026-05-15T17:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-13T16:13:52.596Z",
      "x_nadsec_last_seen": "2026-04-29T19:27:00.675Z",
      "x_nadsec_ports": [
        "81",
        "1723",
        "1883"
      ],
      "x_nadsec_services": [
        "httpd",
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-13T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--bb735259-c370-4064-8160-d91a35b839ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T18:05:10.000Z",
      "valid_until": "2026-05-15T18:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T17:19:40.050Z",
      "x_nadsec_last_seen": "2026-04-13T17:19:40.050Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-13T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=65; services=pptpd; ports=1723; cc=GB",
      "id": "indicator--177aa1d6-eef6-4b58-9720-e945f6ae79b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.38.19.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T18:05:10.000Z",
      "valid_until": "2026-05-15T18:05:08.000Z",
      "x_nadsec_event_count": 65,
      "x_nadsec_first_seen": "2026-04-13T17:47:26.265Z",
      "x_nadsec_last_seen": "2026-04-13T17:47:36.766Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ]
    },
    {
      "created": "2026-04-13T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--969eecad-1dcc-4452-8198-6ad8aedbccdf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '52.180.137.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T18:05:10.000Z",
      "valid_until": "2026-05-15T18:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-13T17:15:17.558Z",
      "x_nadsec_last_seen": "2026-04-13T17:15:27.732Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-13T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--432cc591-ad74-4643-92c5-96affa022791",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '128.14.225.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T19:05:11.000Z",
      "valid_until": "2026-05-15T19:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-13T18:41:56.833Z",
      "x_nadsec_last_seen": "2026-04-15T13:07:02.815Z",
      "x_nadsec_ports": [
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "pptpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-13T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--feb5e362-d129-4d4c-82fc-70fa15b2712a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '52.186.171.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T19:05:11.000Z",
      "valid_until": "2026-05-15T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-13T18:42:18.281Z",
      "x_nadsec_last_seen": "2026-04-13T18:42:19.074Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-13T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--3cc7ea66-e156-494a-bd1c-17691371e217",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T19:05:11.000Z",
      "valid_until": "2026-05-15T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T18:32:23.600Z",
      "x_nadsec_last_seen": "2026-04-13T18:32:23.600Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-13T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--23f09a5d-09aa-4a71-89fa-b693bfebfe02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T19:05:11.000Z",
      "valid_until": "2026-05-15T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T18:13:00.633Z",
      "x_nadsec_last_seen": "2026-04-13T18:13:00.633Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-13T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=JP; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--ffb7076b-32d8-431b-9f3c-638dacbf358e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.194.236.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T20:05:02.000Z",
      "valid_until": "2026-05-15T20:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-13T19:33:41.977Z",
      "x_nadsec_last_seen": "2026-04-13T19:34:03.932Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-13T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=BR; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--792f261e-c7b4-459b-b2c8-419a272a6c91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.197.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T20:05:02.000Z",
      "valid_until": "2026-05-15T20:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-13T19:16:06.801Z",
      "x_nadsec_last_seen": "2026-04-13T19:16:36.604Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-13T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=134420; asn_org=Chongqing Telecom",
      "id": "indicator--63f4c9d7-346c-447b-abd6-1bbb0fdd650d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '219.153.113.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T20:05:02.000Z",
      "valid_until": "2026-05-15T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T19:52:05.165Z",
      "x_nadsec_last_seen": "2026-04-13T19:52:05.165Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "134420"
      ],
      "x_nadsec_orgs": [
        "Chongqing Telecom"
      ]
    },
    {
      "created": "2026-04-13T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--54e88eb3-416d-4352-b160-2ac9742a9718",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.232.108.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T20:05:02.000Z",
      "valid_until": "2026-05-15T20:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-13T19:23:25.978Z",
      "x_nadsec_last_seen": "2026-04-13T19:23:26.063Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-13T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--456ad23f-0eed-44e9-8f43-6cba95b36dff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T20:05:02.000Z",
      "valid_until": "2026-05-15T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T19:28:47.533Z",
      "x_nadsec_last_seen": "2026-04-13T19:28:47.533Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-13T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--5f6e02fa-3444-4495-b2b0-1566e44e029b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T20:05:02.000Z",
      "valid_until": "2026-05-15T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T19:28:47.205Z",
      "x_nadsec_last_seen": "2026-04-13T19:28:47.205Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-13T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=DE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--e117ac69-8fcb-417d-94f0-f2d6f3b794c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.193.59.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T21:05:10.000Z",
      "valid_until": "2026-05-15T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-13T20:20:52.674Z",
      "x_nadsec_last_seen": "2026-04-13T20:21:12.543Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-13T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=mirrorc; ports=43679; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--89640d6f-6b9c-42d9-a1fe-5318a4dc1018",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '159.65.176.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T21:05:10.000Z",
      "valid_until": "2026-05-15T21:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-13T20:12:37.450Z",
      "x_nadsec_last_seen": "2026-04-29T15:05:49.124Z",
      "x_nadsec_ports": [
        "1723",
        "21",
        "42",
        "81",
        "445",
        "1433",
        "3306",
        "43679"
      ],
      "x_nadsec_services": [
        "pptpd",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mssqld",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-13T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--f5f73bc2-1525-46d8-97ea-860f87d654f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '175.2.132.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T21:05:10.000Z",
      "valid_until": "2026-05-15T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-13T20:30:35.417Z",
      "x_nadsec_last_seen": "2026-04-13T20:32:42.134Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-13T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--68d71dfe-0a04-41c5-8ac8-eecb26bd6b76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.43.240.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T21:05:10.000Z",
      "valid_until": "2026-05-15T21:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-13T20:14:49.491Z",
      "x_nadsec_last_seen": "2026-04-13T20:21:39.818Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-13T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6f22bcf2-5657-4a8c-97ed-f02a9cf6d5ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T21:05:10.000Z",
      "valid_until": "2026-05-15T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T21:04:24.308Z",
      "x_nadsec_last_seen": "2026-04-13T21:04:24.308Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-13T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=JP; asn=20473; asn_org=The Constant Company, LLC",
      "id": "indicator--606927b8-5653-4d6f-8ca3-4a018249096c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.32.36.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T21:05:10.000Z",
      "valid_until": "2026-05-15T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T20:44:25.555Z",
      "x_nadsec_last_seen": "2026-04-13T20:44:25.555Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "20473"
      ],
      "x_nadsec_orgs": [
        "The Constant Company, LLC"
      ]
    },
    {
      "created": "2026-04-13T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--28701139-e8dc-4bd4-be58-27fc66f3a690",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '8.138.154.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T21:05:10.000Z",
      "valid_until": "2026-05-15T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-13T20:53:08.671Z",
      "x_nadsec_last_seen": "2026-04-13T20:53:22.185Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ]
    },
    {
      "created": "2026-04-13T22:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=138277; asn_org=Radinet Info Solutions Private Limited",
      "id": "indicator--eecb6b79-4f92-4cf5-bccd-4a5f5ced5802",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T22:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.176.137.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T22:05:21.000Z",
      "valid_until": "2026-05-15T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-13T21:17:54.129Z",
      "x_nadsec_last_seen": "2026-04-13T21:20:00.148Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "138277"
      ],
      "x_nadsec_orgs": [
        "Radinet Info Solutions Private Limited"
      ]
    },
    {
      "created": "2026-04-13T22:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ME; asn=8585; asn_org=Crnogorski Telekom a.d.Podgorica",
      "id": "indicator--5931e912-c4e1-4059-b211-72ecb81c13b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T22:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '109.228.106.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T22:05:21.000Z",
      "valid_until": "2026-05-15T22:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-13T21:15:24.216Z",
      "x_nadsec_last_seen": "2026-04-13T21:22:21.791Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ME"
      ],
      "x_nadsec_asns": [
        "8585"
      ],
      "x_nadsec_orgs": [
        "Crnogorski Telekom a.d.Podgorica"
      ]
    },
    {
      "created": "2026-04-13T22:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a556cdf4-aa88-498c-b8b2-53c89dcba985",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T22:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.237.125.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T22:05:21.000Z",
      "valid_until": "2026-05-15T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-13T21:31:27.002Z",
      "x_nadsec_last_seen": "2026-04-13T21:31:27.388Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-13T22:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CA; asn=16276; asn_org=OVH SAS; user(top)=**",
      "id": "indicator--6f214f42-137e-4ba8-9787-bf8fe2b8e7de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T22:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '15.235.5.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T22:05:21.000Z",
      "valid_until": "2026-05-15T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T21:10:40.324Z",
      "x_nadsec_last_seen": "2026-04-13T21:10:40.324Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-13T22:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mssqld; ports=1433; cc=BR; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--41de92a1-e6a8-4f45-b4b6-5b145e20722f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T22:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.197.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T22:05:21.000Z",
      "valid_until": "2026-05-15T22:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-04-13T21:06:00.417Z",
      "x_nadsec_last_seen": "2026-04-19T19:40:17.142Z",
      "x_nadsec_ports": [
        "1433",
        "21"
      ],
      "x_nadsec_services": [
        "mssqld",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-13T22:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=17072; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--fe9023ff-0354-491f-89db-bccd435e66aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T22:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '187.188.253.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T22:05:21.000Z",
      "valid_until": "2026-05-15T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-13T21:21:20.661Z",
      "x_nadsec_last_seen": "2026-04-13T21:21:20.734Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "17072"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-04-13T22:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--fa60fca5-098b-4aa5-b7bf-f0e55791986c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T22:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.174.228.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T22:05:21.000Z",
      "valid_until": "2026-05-15T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-13T21:43:45.929Z",
      "x_nadsec_last_seen": "2026-04-13T21:43:45.973Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-04-13T22:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--904ff349-5cb8-4e26-a7a8-d339bef9bd15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T22:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T22:05:21.000Z",
      "valid_until": "2026-05-15T22:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-13T21:11:18.916Z",
      "x_nadsec_last_seen": "2026-04-13T21:11:19.636Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-13T22:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--3a983507-431a-46ed-b648-cec9faf7cbe6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T22:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.251.167.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T22:05:21.000Z",
      "valid_until": "2026-05-15T22:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-13T21:18:16.981Z",
      "x_nadsec_last_seen": "2026-04-13T21:18:40.684Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-13T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=61; services=mysqld; ports=3306; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--e53f9666-a0af-4172-a7ad-91059724dc9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '101.132.129.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T23:05:02.000Z",
      "valid_until": "2026-05-15T23:05:01.000Z",
      "x_nadsec_event_count": 61,
      "x_nadsec_first_seen": "2026-04-13T22:29:13.809Z",
      "x_nadsec_last_seen": "2026-04-13T22:34:09.074Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "a***n",
        "a*******v"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-13T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--34801dcc-feaa-4b6d-9bff-5c72d427ee19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T23:05:02.000Z",
      "valid_until": "2026-05-15T23:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-13T22:19:11.980Z",
      "x_nadsec_last_seen": "2026-04-13T22:19:22.140Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-13T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--9df0c2d7-0580-4c50-bd90-6ce624c8578c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T23:05:02.000Z",
      "valid_until": "2026-05-15T23:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T22:44:56.722Z",
      "x_nadsec_last_seen": "2026-04-13T22:44:56.722Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-13T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TR; asn=12735; asn_org=TurkNet Iletisim Hizmetleri A.S.",
      "id": "indicator--088b01b9-ce57-4a40-90e0-7f6398f6bd7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '31.223.52.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T23:05:02.000Z",
      "valid_until": "2026-05-15T23:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-13T22:08:51.289Z",
      "x_nadsec_last_seen": "2026-04-13T22:08:51.393Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "12735"
      ],
      "x_nadsec_orgs": [
        "TurkNet Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-04-14T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--d2a8da0b-e7d9-4432-9ae3-62df93fecbf6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '134.122.118.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T00:05:11.000Z",
      "valid_until": "2026-05-16T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T23:43:00.483Z",
      "x_nadsec_last_seen": "2026-04-13T23:43:00.483Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-14T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--3517c695-3a7c-452e-a618-f4d943ff0a3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T00:05:11.000Z",
      "valid_until": "2026-05-16T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-13T23:42:42.688Z",
      "x_nadsec_last_seen": "2026-04-13T23:42:42.688Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-14T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=28840; asn_org=Pjsc tattelecom",
      "id": "indicator--1dcf459a-73fe-477b-85e1-67829d314bb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.206.227.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T00:05:11.000Z",
      "valid_until": "2026-05-16T00:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-13T23:21:48.323Z",
      "x_nadsec_last_seen": "2026-04-13T23:29:51.039Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "28840"
      ],
      "x_nadsec_orgs": [
        "Pjsc tattelecom"
      ]
    },
    {
      "created": "2026-04-14T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CO; asn=14080; asn_org=Telmex Colombia S.A.",
      "id": "indicator--06275e4f-e0a4-4f60-b542-5816589cceb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.145.231.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T00:05:11.000Z",
      "valid_until": "2026-05-16T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-13T23:44:28.479Z",
      "x_nadsec_last_seen": "2026-04-18T00:00:47.296Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "14080"
      ],
      "x_nadsec_orgs": [
        "Telmex Colombia S.A."
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-14T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=205; services=pptpd; ports=1723; cc=US; asn=210644; asn_org=Aeza Group LLC",
      "id": "indicator--b85ff820-1098-4db4-a62c-9154997875e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '193.233.130.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T00:05:11.000Z",
      "valid_until": "2026-05-16T00:05:09.000Z",
      "x_nadsec_event_count": 205,
      "x_nadsec_first_seen": "2026-04-13T23:19:39.486Z",
      "x_nadsec_last_seen": "2026-04-13T23:20:00.501Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "210644"
      ],
      "x_nadsec_orgs": [
        "Aeza Group LLC"
      ]
    },
    {
      "created": "2026-04-14T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8072721b-ea1c-43fd-9529-d0821811f2de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.83.150.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T00:05:11.000Z",
      "valid_until": "2026-05-16T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-13T23:40:37.031Z",
      "x_nadsec_last_seen": "2026-04-13T23:40:47.420Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-14T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--08aadb53-f162-49cc-8797-6f3025a549f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '203.210.157.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T00:05:11.000Z",
      "valid_until": "2026-05-16T00:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-13T23:13:18.060Z",
      "x_nadsec_last_seen": "2026-04-13T23:17:42.059Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-14T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=NG; asn=36923; asn_org=SWIFTNG-ASN",
      "id": "indicator--2ec5e1f2-58ce-45fb-85da-32a60942a97a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.221.168.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T00:05:11.000Z",
      "valid_until": "2026-05-16T00:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-13T23:26:03.513Z",
      "x_nadsec_last_seen": "2026-04-13T23:31:58.825Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "36923"
      ],
      "x_nadsec_orgs": [
        "SWIFTNG-ASN"
      ]
    },
    {
      "created": "2026-04-14T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--79c53f8e-6b75-4cba-98af-987683b52561",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '58.186.71.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T00:05:11.000Z",
      "valid_until": "2026-05-16T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-13T23:19:46.006Z",
      "x_nadsec_last_seen": "2026-04-13T23:19:47.327Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-04-14T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--e2f58963-6201-4b51-9ed5-64e7e5170dc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T00:05:11.000Z",
      "valid_until": "2026-05-16T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-13T23:53:56.076Z",
      "x_nadsec_last_seen": "2026-04-23T21:13:19.213Z",
      "x_nadsec_ports": [
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-04-14T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--7778318d-9605-473d-a37d-0d8aa916f2c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T01:05:10.000Z",
      "valid_until": "2026-05-16T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T00:36:55.288Z",
      "x_nadsec_last_seen": "2026-04-14T00:36:55.288Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-14T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--c8e81118-13ae-4613-8f5c-9cf4e83be1c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '52.90.148.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T01:05:10.000Z",
      "valid_until": "2026-05-16T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T00:57:35.804Z",
      "x_nadsec_last_seen": "2026-04-14T00:57:35.804Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-14T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--86cfebac-a12f-440e-92de-440f9a9d0d0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T01:05:10.000Z",
      "valid_until": "2026-05-16T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T00:14:11.231Z",
      "x_nadsec_last_seen": "2026-04-14T00:14:11.231Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-04-14T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=135259; asn_org=SKYLINE INFONET PRIVATE LIMITED; user(top)=**",
      "id": "indicator--4ef98add-45d7-4935-bbe3-638f2bf8b550",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.217.154.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T03:05:10.000Z",
      "valid_until": "2026-05-16T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T02:13:42.426Z",
      "x_nadsec_last_seen": "2026-04-14T02:13:42.426Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135259"
      ],
      "x_nadsec_orgs": [
        "SKYLINE INFONET PRIVATE LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-14T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--e15e1530-0f21-4a9c-ad71-7c4dcd070f3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '112.28.79.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T03:05:10.000Z",
      "valid_until": "2026-05-16T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-14T02:53:04.465Z",
      "x_nadsec_last_seen": "2026-04-14T02:55:09.915Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-04-14T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--a9bfd5f3-b2c8-490d-a19c-d4c0644a9cd7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '122.54.127.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T03:05:10.000Z",
      "valid_until": "2026-05-16T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-14T02:11:46.059Z",
      "x_nadsec_last_seen": "2026-04-14T02:13:54.148Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-04-14T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--0040a6bc-b841-4160-ad50-8965fdee9d76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.177.176.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T03:05:10.000Z",
      "valid_until": "2026-05-16T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-14T02:48:54.420Z",
      "x_nadsec_last_seen": "2026-04-14T02:50:59.277Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-14T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--4e66bb3f-c0fd-479d-86ad-27ecedfe0697",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.170.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T03:05:10.000Z",
      "valid_until": "2026-05-16T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T02:30:29.974Z",
      "x_nadsec_last_seen": "2026-04-14T02:30:29.974Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-14T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b70bc937-bfd7-4829-892a-194893cd7f8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '157.230.61.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T03:05:10.000Z",
      "valid_until": "2026-05-16T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T02:36:50.379Z",
      "x_nadsec_last_seen": "2026-04-14T02:36:50.379Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-14T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=GB; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--81c3723a-60e6-4105-a7cf-6cde9a1f1bbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '188.166.154.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T03:05:10.000Z",
      "valid_until": "2026-05-16T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T02:15:17.078Z",
      "x_nadsec_last_seen": "2026-04-14T02:15:17.078Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-14T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--589f59a1-4a41-4c79-a773-8606641c5188",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T03:05:10.000Z",
      "valid_until": "2026-05-16T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-14T02:28:47.748Z",
      "x_nadsec_last_seen": "2026-04-15T05:24:48.632Z",
      "x_nadsec_ports": [
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-14T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=httpd; ports=81; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--567c8256-1a96-4aeb-a615-ee326f356bf9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T03:05:10.000Z",
      "valid_until": "2026-05-16T03:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-14T02:13:31.677Z",
      "x_nadsec_last_seen": "2026-04-14T02:14:00.714Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-14T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--279776ff-3c2c-45ab-8646-962403c7ee75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.118.32.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T03:05:10.000Z",
      "valid_until": "2026-05-16T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T02:26:33.690Z",
      "x_nadsec_last_seen": "2026-04-14T02:26:33.690Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-14T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--216f28ac-ec98-472f-a2b3-f3e4fc70709f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T03:05:10.000Z",
      "valid_until": "2026-05-16T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-14T02:55:18.273Z",
      "x_nadsec_last_seen": "2026-04-30T03:58:28.146Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-14T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=GB; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--57c81971-2456-4b7f-94a5-9971c27db005",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '128.203.203.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T05:05:12.000Z",
      "valid_until": "2026-05-16T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T04:12:16.673Z",
      "x_nadsec_last_seen": "2026-04-14T04:12:16.673Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-14T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--3825cc85-70fa-4614-81aa-63fae8d495ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.163.5.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T05:05:12.000Z",
      "valid_until": "2026-05-16T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-14T04:43:05.202Z",
      "x_nadsec_last_seen": "2026-04-14T04:43:15.378Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-14T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--848b8b54-89e6-402e-8d6c-98cbde101dc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.151.93.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T05:05:12.000Z",
      "valid_until": "2026-05-16T05:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-14T04:54:20.546Z",
      "x_nadsec_last_seen": "2026-04-14T05:01:16.549Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-04-14T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=mongod; ports=27017; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--d5eff5f6-1807-4b92-a564-53ff8da8f8dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T05:05:12.000Z",
      "valid_until": "2026-05-16T05:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-14T04:11:53.921Z",
      "x_nadsec_last_seen": "2026-04-14T04:14:01.942Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-04-14T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--b1331074-b42f-4ede-8b71-c03843a95368",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T05:05:12.000Z",
      "valid_until": "2026-05-16T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T04:13:41.589Z",
      "x_nadsec_last_seen": "2026-04-14T04:13:41.589Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-04-14T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--38772244-17d8-487b-b1b1-a0191ddc4e20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T05:05:12.000Z",
      "valid_until": "2026-05-16T05:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-14T04:12:34.407Z",
      "x_nadsec_last_seen": "2026-04-14T04:12:56.054Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-04-14T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--b311c35f-b65a-48dc-b9b9-ae03ac758e4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T05:05:12.000Z",
      "valid_until": "2026-05-16T05:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-14T04:11:54.447Z",
      "x_nadsec_last_seen": "2026-04-14T04:13:48.091Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-04-14T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--34f2322a-8dc2-4070-a150-524823b3f4e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T05:05:12.000Z",
      "valid_until": "2026-05-16T05:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-14T04:33:55.734Z",
      "x_nadsec_last_seen": "2026-04-19T15:53:28.886Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-14T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--c7e96d16-cee6-4ab1-8096-06e9e4477f16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T05:05:12.000Z",
      "valid_until": "2026-05-16T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-09T03:18:11.652Z",
      "x_nadsec_last_seen": "2026-04-16T01:13:16.799Z",
      "x_nadsec_ports": [
        "27017",
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "mongod",
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-04-14T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--60063435-590b-4452-b7e0-c58309a67332",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.185.217.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T06:05:10.000Z",
      "valid_until": "2026-05-16T06:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-14T05:30:14.362Z",
      "x_nadsec_last_seen": "2026-04-14T05:32:20.304Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-04-14T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--5691b237-ec99-4e5d-934d-be29c5494266",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T06:05:10.000Z",
      "valid_until": "2026-05-16T06:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T05:17:12.197Z",
      "x_nadsec_last_seen": "2026-04-14T05:17:12.197Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-04-14T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--93f2260f-0a6e-45ed-bbdf-2218898d6272",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.129.46.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T06:05:10.000Z",
      "valid_until": "2026-05-16T06:05:08.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-04-14T05:07:12.394Z",
      "x_nadsec_last_seen": "2026-04-14T05:09:20.881Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-04-14T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f60341cf-da5a-4c82-8b08-04b112b4dfa3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.168.122.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T06:05:10.000Z",
      "valid_until": "2026-05-16T06:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T05:17:49.733Z",
      "x_nadsec_last_seen": "2026-04-14T05:17:49.733Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-14T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--bb553741-a276-4303-ae88-768156cf3545",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T06:05:10.000Z",
      "valid_until": "2026-05-16T06:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T05:31:32.524Z",
      "x_nadsec_last_seen": "2026-04-14T05:31:32.524Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-14T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--4bbd940a-9564-41bf-8ece-2340057c6bd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '89.250.170.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T06:05:10.000Z",
      "valid_until": "2026-05-16T06:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-14T05:15:49.892Z",
      "x_nadsec_last_seen": "2026-04-16T17:43:54.489Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-14T07:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=HK; asn=132883; asn_org=TOPWAY GLOBAL LIMITED",
      "id": "indicator--dafe0464-c7ce-4d58-8d55-e073a4d1a80f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T07:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.27.109.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T07:05:16.000Z",
      "valid_until": "2026-05-16T07:05:15.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-14T06:50:40.213Z",
      "x_nadsec_last_seen": "2026-04-16T18:37:24.300Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "132883"
      ],
      "x_nadsec_orgs": [
        "TOPWAY GLOBAL LIMITED"
      ]
    },
    {
      "created": "2026-04-14T07:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d89e2e59-00ef-45a2-a377-684b61219600",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T07:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.203.245.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T07:05:16.000Z",
      "valid_until": "2026-05-16T07:05:15.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-14T06:20:53.790Z",
      "x_nadsec_last_seen": "2026-04-14T06:20:54.185Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-14T07:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--68147502-567b-4e8b-b551-6be66d6f7617",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T07:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '180.241.251.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T07:05:16.000Z",
      "valid_until": "2026-05-16T07:05:15.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-14T06:30:18.227Z",
      "x_nadsec_last_seen": "2026-04-14T06:32:23.258Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-14T07:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--c65e191b-91e3-481c-80ae-3bf3ba9310e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T07:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '39.33.0.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T07:05:16.000Z",
      "valid_until": "2026-05-16T07:05:15.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-14T06:59:51.348Z",
      "x_nadsec_last_seen": "2026-04-14T07:04:00.878Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-04-14T07:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--50709f59-da31-4a49-add8-d4bc176f525b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T07:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T07:05:16.000Z",
      "valid_until": "2026-05-16T07:05:15.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-14T06:31:17.251Z",
      "x_nadsec_last_seen": "2026-04-30T03:32:46.970Z",
      "x_nadsec_ports": [
        "1883",
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-14T07:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--76583976-535d-482c-bb3e-6bedca55fc99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T07:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '8.221.136.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T07:05:16.000Z",
      "valid_until": "2026-05-16T07:05:15.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-14T06:26:54.065Z",
      "x_nadsec_last_seen": "2026-04-14T06:27:20.665Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-14T07:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--57ab1f7a-55ab-4ab9-98f8-e74e0a090047",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T07:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T07:05:16.000Z",
      "valid_until": "2026-05-16T07:05:15.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T06:20:15.271Z",
      "x_nadsec_last_seen": "2026-04-14T06:20:15.271Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-14T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=VN; asn=18403; asn_org=FPT Telecom Company; user(top)=**",
      "id": "indicator--f88a4c5a-1c37-42cd-a390-5a997bb8dc3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.70.236.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T08:05:05.000Z",
      "valid_until": "2026-05-16T08:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T07:37:17.311Z",
      "x_nadsec_last_seen": "2026-04-14T07:37:17.311Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-14T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=smbd; ports=445; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--ca6b8840-594f-4f09-8bbf-3629c0d4081a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.128.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T08:05:05.000Z",
      "valid_until": "2026-05-16T08:05:04.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-04-14T07:56:32.939Z",
      "x_nadsec_last_seen": "2026-04-14T07:57:28.161Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-14T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FI; asn=57043; asn_org=Hostkey B.v.",
      "id": "indicator--adbccbbc-e8e6-48d1-85e8-c037e3071b75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '212.237.217.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T08:05:05.000Z",
      "valid_until": "2026-05-16T08:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T07:35:31.653Z",
      "x_nadsec_last_seen": "2026-04-14T07:35:31.653Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FI"
      ],
      "x_nadsec_asns": [
        "57043"
      ],
      "x_nadsec_orgs": [
        "Hostkey B.v."
      ]
    },
    {
      "created": "2026-04-14T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AZ; asn=49345; asn_org=Beeonline Ojsc",
      "id": "indicator--eaba8bb6-4583-4c5c-aac6-98e60234311b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '31.171.1.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T08:05:05.000Z",
      "valid_until": "2026-05-16T08:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-14T07:28:48.179Z",
      "x_nadsec_last_seen": "2026-04-14T07:36:03.615Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "49345"
      ],
      "x_nadsec_orgs": [
        "Beeonline Ojsc"
      ]
    },
    {
      "created": "2026-04-14T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=UA",
      "id": "indicator--6873ba37-dac2-4b19-92e1-8fa54abb9ee6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.52.13.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T08:05:05.000Z",
      "valid_until": "2026-05-16T08:05:04.000Z",
      "x_nadsec_event_count": 45,
      "x_nadsec_first_seen": "2026-04-14T07:13:29.164Z",
      "x_nadsec_last_seen": "2026-04-14T07:15:42.546Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ]
    },
    {
      "created": "2026-04-14T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--1185d4ee-4857-47a4-b994-7ea7f09fa468",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.174.200.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T08:05:05.000Z",
      "valid_until": "2026-05-16T08:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-14T07:11:35.559Z",
      "x_nadsec_last_seen": "2026-04-14T07:13:43.123Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-14T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e929bb18-81f5-4737-ae22-66274ca8669a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.93.168.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T09:05:10.000Z",
      "valid_until": "2026-05-16T09:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-04-14T08:17:26.344Z",
      "x_nadsec_last_seen": "2026-04-14T08:18:28.915Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-14T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--309c19e2-d5ab-4c17-a91e-53f10714cee1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.211.13.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T09:05:10.000Z",
      "valid_until": "2026-05-16T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-14T08:42:04.132Z",
      "x_nadsec_last_seen": "2026-04-14T08:44:11.836Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-14T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--b2238cf4-5e78-40c4-98c1-4f0434b730e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.189.58.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T09:05:10.000Z",
      "valid_until": "2026-05-16T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-14T08:28:05.846Z",
      "x_nadsec_last_seen": "2026-04-14T08:30:12.692Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-04-14T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--22f8960b-2975-4921-a570-ecf590aec0c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '203.162.7.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T09:05:10.000Z",
      "valid_until": "2026-05-16T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T08:10:47.085Z",
      "x_nadsec_last_seen": "2026-04-14T08:10:47.085Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-14T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--3f40292f-2679-42b4-b3cc-867b0a230abd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.14.59.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T09:05:10.000Z",
      "valid_until": "2026-05-16T09:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-14T08:41:55.453Z",
      "x_nadsec_last_seen": "2026-04-18T19:31:04.484Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-14T10:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--59a51957-7223-41b0-b581-aefdf40e83d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T10:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '122.225.52.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T10:05:05.000Z",
      "valid_until": "2026-05-16T10:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-14T09:57:02.807Z",
      "x_nadsec_last_seen": "2026-04-14T09:57:03.161Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-14T10:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=131269; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--033a6388-5514-4194-8b67-1ff24404731a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T10:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '124.123.26.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T10:05:05.000Z",
      "valid_until": "2026-05-16T10:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-14T09:20:07.946Z",
      "x_nadsec_last_seen": "2026-04-14T09:20:08.154Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "131269"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-04-14T10:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=136; services=smbd; ports=445; cc=GB; asn=201579; asn_org=Hostgnome Ltd",
      "id": "indicator--d1df47cd-1c82-4870-be16-a1671d967f74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T10:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.91.69.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T10:05:05.000Z",
      "valid_until": "2026-05-16T10:05:03.000Z",
      "x_nadsec_event_count": 136,
      "x_nadsec_first_seen": "2026-04-14T09:19:43.359Z",
      "x_nadsec_last_seen": "2026-04-14T09:59:02.376Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "201579"
      ],
      "x_nadsec_orgs": [
        "Hostgnome Ltd"
      ]
    },
    {
      "created": "2026-04-14T10:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--2208c053-86cf-4af3-9d0f-495b51de7c7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T10:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.96.160.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T10:05:05.000Z",
      "valid_until": "2026-05-16T10:05:03.000Z",
      "x_nadsec_event_count": 3148,
      "x_nadsec_first_seen": "2026-04-14T09:54:44.153Z",
      "x_nadsec_last_seen": "2026-04-14T11:51:41.029Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-04-14T11:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--85d8e66d-fae4-4133-9f15-df67668cce39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T11:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T11:05:08.000Z",
      "valid_until": "2026-05-16T11:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-14T10:24:13.977Z",
      "x_nadsec_last_seen": "2026-04-26T14:14:22.851Z",
      "x_nadsec_ports": [
        "445",
        "135"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-14T11:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=23158; asn_org=ETEX COMMUNICATIONS, LLC",
      "id": "indicator--776807b6-aac6-44ee-a6a1-34c69d3ed8b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T11:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '67.216.98.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T11:05:08.000Z",
      "valid_until": "2026-05-16T11:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-14T10:36:05.190Z",
      "x_nadsec_last_seen": "2026-04-14T10:36:10.336Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "23158"
      ],
      "x_nadsec_orgs": [
        "ETEX COMMUNICATIONS, LLC"
      ]
    },
    {
      "created": "2026-04-14T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--381ef45d-653f-4785-888d-2ef4037ff877",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T12:05:11.000Z",
      "valid_until": "2026-05-16T12:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-14T11:08:09.151Z",
      "x_nadsec_last_seen": "2026-04-28T03:41:59.673Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-14T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=41704; asn_org=JSC Ufanet",
      "id": "indicator--114658b7-8001-48fb-b59b-0b35ac1b3c83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '136.169.243.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T13:05:06.000Z",
      "valid_until": "2026-05-16T13:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-14T12:38:38.086Z",
      "x_nadsec_last_seen": "2026-04-14T12:46:23.748Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "41704"
      ],
      "x_nadsec_orgs": [
        "JSC Ufanet"
      ]
    },
    {
      "created": "2026-04-14T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=50241; asn_org=Unittel Ltd",
      "id": "indicator--140d8ae3-2b88-4b71-ac30-545f06c50d02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.115.199.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T13:05:06.000Z",
      "valid_until": "2026-05-16T13:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-14T12:20:13.047Z",
      "x_nadsec_last_seen": "2026-04-14T12:27:12.604Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "50241"
      ],
      "x_nadsec_orgs": [
        "Unittel Ltd"
      ]
    },
    {
      "created": "2026-04-14T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=NL; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--8a1bba7a-56bb-412d-99b9-ce6d1de17e54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.62.243.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T13:05:06.000Z",
      "valid_until": "2026-05-16T13:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T12:07:46.695Z",
      "x_nadsec_last_seen": "2026-04-14T12:07:46.695Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-14T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BO; asn=26210; asn_org=AXS Bolivia S. A.",
      "id": "indicator--4f5b00c3-dcc4-442b-8354-178a0e99d384",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.181.22.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T13:05:06.000Z",
      "valid_until": "2026-05-16T13:05:03.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-14T12:38:30.987Z",
      "x_nadsec_last_seen": "2026-04-17T21:20:25.558Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "26210"
      ],
      "x_nadsec_orgs": [
        "AXS Bolivia S. A."
      ]
    },
    {
      "created": "2026-04-14T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--4d68b9ee-60d5-43ff-a1f6-3ec69e6dde3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.84.102.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T13:05:06.000Z",
      "valid_until": "2026-05-16T13:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-14T12:46:16.371Z",
      "x_nadsec_last_seen": "2026-04-14T12:46:39.919Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-14T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=JO; asn=8376; asn_org=Jordan Data Communications Company LLC",
      "id": "indicator--65e07e0d-3098-49eb-992e-9f2f44194215",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '86.108.109.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T13:05:06.000Z",
      "valid_until": "2026-05-16T13:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-14T12:46:18.583Z",
      "x_nadsec_last_seen": "2026-04-14T12:48:25.485Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "8376"
      ],
      "x_nadsec_orgs": [
        "Jordan Data Communications Company LLC"
      ]
    },
    {
      "created": "2026-04-14T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--c4511a06-8af0-4020-b77f-5611ef958cf7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '88.204.143.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T13:05:06.000Z",
      "valid_until": "2026-05-16T13:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-14T12:15:17.666Z",
      "x_nadsec_last_seen": "2026-04-14T12:17:24.146Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-04-14T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=35507; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--b3845628-03e8-44a0-b814-05a5ee81d7de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T13:05:06.000Z",
      "valid_until": "2026-05-16T13:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-14T12:46:04.466Z",
      "x_nadsec_last_seen": "2026-04-14T12:46:04.474Z",
      "x_nadsec_ports": [
        "42",
        "35507"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-14T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrord; ports=42; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--edfe4c58-433c-4cd2-ab1d-69c0ef2a7f4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T13:05:06.000Z",
      "valid_until": "2026-05-16T13:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-14T12:46:05.085Z",
      "x_nadsec_last_seen": "2026-04-21T13:53:28.763Z",
      "x_nadsec_ports": [
        "42",
        "135",
        "46137"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-14T14:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--c3a8f6d1-5668-4b72-85d7-22f72eff3822",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T14:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.45.71.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T14:05:12.000Z",
      "valid_until": "2026-05-16T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T13:22:37.338Z",
      "x_nadsec_last_seen": "2026-04-14T13:22:37.338Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-14T14:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--067bb73f-f3b1-4234-a3c3-d435b3fd53e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T14:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.105.64.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T14:05:12.000Z",
      "valid_until": "2026-05-16T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-14T13:07:07.098Z",
      "x_nadsec_last_seen": "2026-04-14T13:09:11.314Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-04-14T14:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--32133883-2453-46ad-954f-4a17b7002f8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T14:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.180.110.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T14:05:12.000Z",
      "valid_until": "2026-05-16T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T13:20:31.175Z",
      "x_nadsec_last_seen": "2026-04-14T13:20:31.175Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-14T14:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--c90e68bb-295c-433d-84ab-714f58b7d858",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T14:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.180.251.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T14:05:12.000Z",
      "valid_until": "2026-05-16T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T13:20:30.857Z",
      "x_nadsec_last_seen": "2026-04-14T13:20:30.857Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-14T14:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MX; asn=13999; asn_org=Mega Cable, S.A. de C.V.; user(top)=**",
      "id": "indicator--b26951bf-f97f-48fa-bd38-0b1b51d54686",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T14:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.195.176.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T14:05:12.000Z",
      "valid_until": "2026-05-16T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T13:52:18.135Z",
      "x_nadsec_last_seen": "2026-04-14T13:52:18.135Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "13999"
      ],
      "x_nadsec_orgs": [
        "Mega Cable, S.A. de C.V."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-14T14:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--5af46d8a-7af2-4ee9-a8c7-879677741944",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T14:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.36.161.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T14:05:12.000Z",
      "valid_until": "2026-05-16T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T13:22:35.757Z",
      "x_nadsec_last_seen": "2026-04-14T13:22:35.757Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-14T14:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d45cfbef-b7a4-4288-9ffe-7b064b78409d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T14:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T14:05:12.000Z",
      "valid_until": "2026-05-16T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T13:51:44.910Z",
      "x_nadsec_last_seen": "2026-04-14T13:51:44.910Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-14T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d4fad27c-226d-4466-9eee-a2c134d7332e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '13.86.104.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T15:05:05.000Z",
      "valid_until": "2026-05-16T15:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T14:54:32.383Z",
      "x_nadsec_last_seen": "2026-04-14T14:54:32.383Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-14T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--fe3c6ad1-5738-4742-8bed-26c607800497",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.138.158.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T15:05:05.000Z",
      "valid_until": "2026-05-16T15:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T15:01:26.130Z",
      "x_nadsec_last_seen": "2026-04-14T15:01:26.130Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-14T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--133bd63f-3897-4a3b-bf07-4eca6dcaef4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.88.190.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T15:05:05.000Z",
      "valid_until": "2026-05-16T15:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T15:01:24.373Z",
      "x_nadsec_last_seen": "2026-04-14T15:01:24.373Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-04-14T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--4082be19-8318-466d-a4c1-928fda2de96b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '220.250.11.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T15:05:05.000Z",
      "valid_until": "2026-05-16T15:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T15:01:33.505Z",
      "x_nadsec_last_seen": "2026-04-14T15:01:33.505Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-04-14T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--d8cf2a1b-9b2b-4f1c-b96d-733e10791972",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '220.250.11.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T15:05:05.000Z",
      "valid_until": "2026-05-16T15:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T15:01:28.629Z",
      "x_nadsec_last_seen": "2026-04-14T15:01:28.629Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-04-14T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--bd8bfaf3-cf8f-41eb-b898-09427d4a1922",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T15:05:05.000Z",
      "valid_until": "2026-05-16T15:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-14T14:30:24.122Z",
      "x_nadsec_last_seen": "2026-04-27T07:20:21.157Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-14T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--db15b4d4-2881-45ba-a867-12bb6ca4d920",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '116.97.104.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T16:05:10.000Z",
      "valid_until": "2026-05-16T16:05:09.000Z",
      "x_nadsec_event_count": 45,
      "x_nadsec_first_seen": "2026-04-14T15:42:31.894Z",
      "x_nadsec_last_seen": "2026-04-14T15:44:42.435Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-14T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--54b368b7-6a92-48cd-a6f9-d7ada7806f66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T16:05:10.000Z",
      "valid_until": "2026-05-16T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T15:08:09.832Z",
      "x_nadsec_last_seen": "2026-04-14T15:08:09.832Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-14T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=UA; asn=15895; asn_org=Kyivstar PJSC",
      "id": "indicator--cc283db4-3fb9-4309-8b42-77eaf4f53aa8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.27.50.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T16:05:10.000Z",
      "valid_until": "2026-05-16T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T03:31:40.878Z",
      "x_nadsec_last_seen": "2026-04-14T15:25:27.631Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "15895"
      ],
      "x_nadsec_orgs": [
        "Kyivstar PJSC"
      ]
    },
    {
      "created": "2026-04-14T17:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=63737; asn_org=VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
      "id": "indicator--18b20513-66bf-4f88-84f0-782cc9fc1a6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T17:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '157.10.48.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T17:05:12.000Z",
      "valid_until": "2026-05-16T17:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-14T16:37:57.360Z",
      "x_nadsec_last_seen": "2026-04-24T11:25:16.772Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "63737"
      ],
      "x_nadsec_orgs": [
        "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-14T17:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BR; asn=26599; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--52d11bb7-3dc3-46f9-85d9-35ef5272ee25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T17:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '177.174.124.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T17:05:12.000Z",
      "valid_until": "2026-05-16T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-14T17:03:49.751Z",
      "x_nadsec_last_seen": "2026-04-14T17:05:57.089Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "26599"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-04-14T17:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6103950a-9a22-4626-b968-64466915fdf9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T17:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T17:05:12.000Z",
      "valid_until": "2026-05-16T17:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-07T00:38:00.708Z",
      "x_nadsec_last_seen": "2026-04-14T16:50:34.676Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-14T17:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=36992; asn_org=Etisalat Misr",
      "id": "indicator--e9518c9f-6bf5-4a3d-94e5-abd9d19dad3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T17:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.65.226.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T17:05:12.000Z",
      "valid_until": "2026-05-16T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-14T16:23:42.262Z",
      "x_nadsec_last_seen": "2026-04-14T16:31:37.741Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "36992"
      ],
      "x_nadsec_orgs": [
        "Etisalat Misr"
      ]
    },
    {
      "created": "2026-04-14T17:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=200730; asn_org=ISAEV Igor",
      "id": "indicator--4c480ba0-6f11-47cd-a06d-16a6b7968d91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T17:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.251.64.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T17:05:12.000Z",
      "valid_until": "2026-05-16T17:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-14T16:46:31.744Z",
      "x_nadsec_last_seen": "2026-04-15T10:42:28.253Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "PL",
        "US"
      ],
      "x_nadsec_asns": [
        "200730"
      ],
      "x_nadsec_orgs": [
        "ISAEV Igor"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-14T18:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=138754; asn_org=Kerala Vision Broad Band Private Limited; user(top)=**",
      "id": "indicator--ba59840e-86a1-469c-8f28-cae6ba490ace",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T18:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.161.145.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T18:05:15.000Z",
      "valid_until": "2026-05-16T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T17:27:53.874Z",
      "x_nadsec_last_seen": "2026-04-14T17:27:53.874Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "138754"
      ],
      "x_nadsec_orgs": [
        "Kerala Vision Broad Band Private Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-14T18:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--046773a6-c58b-4476-a7cd-1f749f2a0add",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T18:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.161.189.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T18:05:15.000Z",
      "valid_until": "2026-05-16T18:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-14T17:45:45.739Z",
      "x_nadsec_last_seen": "2026-04-14T17:51:56.203Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-04-14T18:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--278daf4e-503a-4915-b4f9-95f9ff5bc04c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T18:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T18:05:15.000Z",
      "valid_until": "2026-05-16T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-14T17:14:44.588Z",
      "x_nadsec_last_seen": "2026-04-29T21:18:08.070Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-14T18:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IL; asn=8551; asn_org=Bezeq International Ltd.",
      "id": "indicator--348399ed-7bb7-421e-b2fb-f2f513e46593",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T18:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '31.168.231.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T18:05:15.000Z",
      "valid_until": "2026-05-16T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-14T17:58:03.446Z",
      "x_nadsec_last_seen": "2026-04-14T18:00:10.178Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IL"
      ],
      "x_nadsec_asns": [
        "8551"
      ],
      "x_nadsec_orgs": [
        "Bezeq International Ltd."
      ]
    },
    {
      "created": "2026-04-14T18:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.; user(top)=a*******s; pass(top)=a********@",
      "id": "indicator--ff1351ae-2dda-4913-bcb0-59827ebfd946",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T18:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T18:05:15.000Z",
      "valid_until": "2026-05-16T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T18:02:30.594Z",
      "x_nadsec_last_seen": "2026-04-14T18:02:30.594Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-04-14T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--c9d82361-408e-4f37-a526-797f05f3faa3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T21:05:13.000Z",
      "valid_until": "2026-05-16T21:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T21:02:38.717Z",
      "x_nadsec_last_seen": "2026-04-14T21:02:38.717Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-14T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--21d3d33e-164d-405f-80b5-003c4d6f60ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T21:05:13.000Z",
      "valid_until": "2026-05-16T21:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T21:02:38.472Z",
      "x_nadsec_last_seen": "2026-04-14T21:02:38.472Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-14T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--a3bfd202-9bfb-4638-99c3-b066a5b932d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T21:05:13.000Z",
      "valid_until": "2026-05-16T21:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T21:03:03.175Z",
      "x_nadsec_last_seen": "2026-04-14T21:03:03.175Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-14T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--91bacfa8-d322-45ee-b170-a9965e6febdb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T21:05:13.000Z",
      "valid_until": "2026-05-16T21:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T21:03:13.435Z",
      "x_nadsec_last_seen": "2026-04-14T21:03:13.435Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-14T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--30975d7c-e9cd-41a5-8366-1728c1b602ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T21:05:13.000Z",
      "valid_until": "2026-05-16T21:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T20:24:24.865Z",
      "x_nadsec_last_seen": "2026-04-14T20:24:24.865Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-14T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--11cd300a-cbe3-4a04-9fb6-1f29606749c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T21:05:13.000Z",
      "valid_until": "2026-05-16T21:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T21:00:51.976Z",
      "x_nadsec_last_seen": "2026-04-14T21:00:51.976Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-14T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrord; ports=42; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--17ab4256-2a8d-4b15-ad28-2208d169bd7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T21:05:13.000Z",
      "valid_until": "2026-05-16T21:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-14T20:13:47.850Z",
      "x_nadsec_last_seen": "2026-04-25T13:24:43.941Z",
      "x_nadsec_ports": [
        "42",
        "1883",
        "37759",
        "45345"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-14T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--c94f60b0-0106-45ea-8797-b77d70aff7a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T21:05:13.000Z",
      "valid_until": "2026-05-16T21:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T20:14:40.626Z",
      "x_nadsec_last_seen": "2026-04-14T20:14:40.626Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-14T22:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--c696cbdf-825f-46f2-8797-1724085581db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T22:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.245.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T22:05:12.000Z",
      "valid_until": "2026-05-16T22:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-14T21:16:10.958Z",
      "x_nadsec_last_seen": "2026-04-23T19:23:23.399Z",
      "x_nadsec_ports": [
        "1433",
        "21"
      ],
      "x_nadsec_services": [
        "mssqld",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "",
        "a*******s"
      ]
    },
    {
      "created": "2026-04-14T22:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.; user(top)=a*******s; pass(top)=a********@",
      "id": "indicator--e7e3d0df-3026-406e-abd0-68b6f3333ee4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T22:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.97.19.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T22:05:12.000Z",
      "valid_until": "2026-05-16T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T21:47:13.118Z",
      "x_nadsec_last_seen": "2026-04-14T21:47:13.118Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-04-14T22:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.; user(top)=a*******s; pass(top)=a********@",
      "id": "indicator--f2f11b2a-a8ac-4595-9919-8ec1eb15366d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T22:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.97.19.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T22:05:12.000Z",
      "valid_until": "2026-05-16T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T21:38:44.829Z",
      "x_nadsec_last_seen": "2026-04-14T21:38:44.829Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-04-14T22:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--412cf9c1-86e7-4c0b-9c5f-7da0a26cadb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T22:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.205.60.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T22:05:12.000Z",
      "valid_until": "2026-05-16T22:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-14T21:27:52.773Z",
      "x_nadsec_last_seen": "2026-04-14T21:34:56.726Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-04-14T22:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.; user(top)=a*******s; pass(top)=a********@",
      "id": "indicator--70367df4-11e0-45c6-bfe2-b77553b3fdd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T22:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T22:05:12.000Z",
      "valid_until": "2026-05-16T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T21:21:55.173Z",
      "x_nadsec_last_seen": "2026-04-14T21:21:55.173Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-04-14T22:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--a1b9b91e-7300-4fc4-9226-8fbe96cde816",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T22:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T22:05:12.000Z",
      "valid_until": "2026-05-16T22:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-14T21:26:43.342Z",
      "x_nadsec_last_seen": "2026-04-29T23:37:48.943Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-14T23:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=GB; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a7458518-54ba-4140-9b8d-b97b97be6099",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T23:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '144.126.205.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T23:05:04.000Z",
      "valid_until": "2026-05-16T23:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-14T22:44:29.467Z",
      "x_nadsec_last_seen": "2026-04-14T22:44:32.741Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-14T23:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=IN; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--e6cfc575-3091-4ac7-93cc-ada86ce9be8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T23:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.159.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T23:05:04.000Z",
      "valid_until": "2026-05-16T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-14T22:05:33.726Z",
      "x_nadsec_last_seen": "2026-04-14T22:06:02.511Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-14T23:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--edd5cc14-696a-42bb-a953-f7fa2f747bb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T23:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T23:05:04.000Z",
      "valid_until": "2026-05-16T23:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T22:55:35.930Z",
      "x_nadsec_last_seen": "2026-04-14T22:55:35.930Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-15T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=133660; asn_org=PRISAC AVIATION TECHNOLOGIES PRIVATE LIMITED",
      "id": "indicator--50b8dfab-a5fe-43b7-8355-9b7f26d4aad3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.42.87.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T00:05:12.000Z",
      "valid_until": "2026-05-17T00:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-14T23:05:10.884Z",
      "x_nadsec_last_seen": "2026-04-14T23:05:14.686Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133660"
      ],
      "x_nadsec_orgs": [
        "PRISAC AVIATION TECHNOLOGIES PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-04-15T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=PH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--d08796e6-2e0d-4623-a6e3-ae2ccd3e2809",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.193.73.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T00:05:12.000Z",
      "valid_until": "2026-05-17T00:05:09.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-04-14T23:57:57.976Z",
      "x_nadsec_last_seen": "2026-04-28T12:05:00.244Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "1883"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-15T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=PH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--e79c11e1-9f9e-48a0-9116-47e2beab1b72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.100.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T00:05:12.000Z",
      "valid_until": "2026-05-17T00:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-14T23:26:16.545Z",
      "x_nadsec_last_seen": "2026-04-29T19:44:52.016Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-15T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=51167; asn_org=Contabo GmbH",
      "id": "indicator--a09ca5d6-de40-4a64-9c92-f59278812a82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '31.220.89.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T00:05:12.000Z",
      "valid_until": "2026-05-17T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T23:24:34.563Z",
      "x_nadsec_last_seen": "2026-04-14T23:24:34.563Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "51167"
      ],
      "x_nadsec_orgs": [
        "Contabo GmbH"
      ]
    },
    {
      "created": "2026-04-15T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.; user(top)=a*******s; pass(top)=a********@",
      "id": "indicator--a4cad4b1-474d-41fb-b52d-295f8d1932e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T00:05:12.000Z",
      "valid_until": "2026-05-17T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-14T23:59:50.396Z",
      "x_nadsec_last_seen": "2026-04-14T23:59:50.396Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-04-15T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=epmapper; ports=135; cc=NL; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--3c86b5e8-a474-4d02-90d8-2233e59bede2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.183.1.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T00:05:12.000Z",
      "valid_until": "2026-05-17T00:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-04-14T23:26:03.690Z",
      "x_nadsec_last_seen": "2026-04-22T14:54:57.669Z",
      "x_nadsec_ports": [
        "1723",
        "21",
        "42",
        "81",
        "135",
        "445",
        "1433",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "pptpd",
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-15T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--daf37921-875c-459c-814d-f4ba7c5f0751",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '83.171.96.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T00:05:12.000Z",
      "valid_until": "2026-05-17T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-14T23:08:49.490Z",
      "x_nadsec_last_seen": "2026-04-14T23:10:57.758Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-15T01:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--88503f2e-b1f6-4707-b2ca-7bb6c53fcd39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T01:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '117.0.188.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:05:21.000Z",
      "valid_until": "2026-05-17T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T01:03:49.119Z",
      "x_nadsec_last_seen": "2026-04-15T01:03:49.119Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-15T01:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--15710d81-0f1f-4204-9b1f-189395ca563f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T01:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.129.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:05:21.000Z",
      "valid_until": "2026-05-17T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-15T00:17:31.346Z",
      "x_nadsec_last_seen": "2026-04-23T21:19:13.637Z",
      "x_nadsec_ports": [
        "1433",
        "1723"
      ],
      "x_nadsec_services": [
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-15T01:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--d4d4cfdb-4070-440a-8993-7c6a2cab133f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T01:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.234.210.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:05:21.000Z",
      "valid_until": "2026-05-17T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T00:53:27.984Z",
      "x_nadsec_last_seen": "2026-04-15T00:53:27.984Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-15T01:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=37340; asn_org=Spectranet",
      "id": "indicator--485cf39d-1e12-49c8-826a-2b784b7fa88f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T01:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.242.125.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:05:21.000Z",
      "valid_until": "2026-05-17T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-15T00:51:14.404Z",
      "x_nadsec_last_seen": "2026-04-15T00:53:21.111Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "37340"
      ],
      "x_nadsec_orgs": [
        "Spectranet"
      ]
    },
    {
      "created": "2026-04-15T01:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--da09b76c-632f-45e7-bbd2-ebd5b227212f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T01:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:05:21.000Z",
      "valid_until": "2026-05-17T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T00:09:51.568Z",
      "x_nadsec_last_seen": "2026-04-15T00:09:51.568Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-15T01:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--31be608e-fadd-425a-836e-e1a2950d50be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T01:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.64.104.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:05:21.000Z",
      "valid_until": "2026-05-17T01:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-15T00:54:25.566Z",
      "x_nadsec_last_seen": "2026-04-16T22:42:24.428Z",
      "x_nadsec_ports": [
        "445",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-15T01:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--b81fbc65-9c8c-4bf6-8c79-55c555d255a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T01:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.79.214.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:05:21.000Z",
      "valid_until": "2026-05-17T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-15T01:00:45.649Z",
      "x_nadsec_last_seen": "2026-04-15T01:02:50.625Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-15T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--7e293ef4-3adc-47b8-8d29-40eec80f434a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '124.235.120.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T02:05:13.000Z",
      "valid_until": "2026-05-17T02:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-15T01:32:10.416Z",
      "x_nadsec_last_seen": "2026-04-15T01:32:17.086Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-15T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--976a57a9-b8a7-4deb-8283-b24f352560a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.241.58.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T02:05:13.000Z",
      "valid_until": "2026-05-17T02:05:02.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-15T01:09:54.241Z",
      "x_nadsec_last_seen": "2026-04-15T01:11:59.099Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-04-15T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=4538; asn_org=China Education and Research Network Center",
      "id": "indicator--0057098c-6e8d-44e4-af0d-293d4a120578",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '202.120.23.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T02:05:13.000Z",
      "valid_until": "2026-05-17T02:05:02.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-15T01:57:58.310Z",
      "x_nadsec_last_seen": "2026-04-15T01:58:01.844Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4538"
      ],
      "x_nadsec_orgs": [
        "China Education and Research Network Center"
      ]
    },
    {
      "created": "2026-04-15T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--d10ac882-5034-4df3-b87f-a3d19570ad39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T02:05:13.000Z",
      "valid_until": "2026-05-17T02:05:02.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-15T01:14:39.384Z",
      "x_nadsec_last_seen": "2026-04-23T00:05:42.613Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-15T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=9924; asn_org=Taiwan Fixed Network, Telco and Network Service Provider.",
      "id": "indicator--f6d3ff96-feec-40f7-b58e-c724cc00bac5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '219.80.117.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T02:05:13.000Z",
      "valid_until": "2026-05-17T02:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-15T01:54:02.747Z",
      "x_nadsec_last_seen": "2026-04-15T01:56:07.605Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "9924"
      ],
      "x_nadsec_orgs": [
        "Taiwan Fixed Network, Telco and Network Service Provider."
      ]
    },
    {
      "created": "2026-04-15T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=56046; asn_org=China Mobile communications corporation; user(top)=**; pass(top)=***",
      "id": "indicator--e0df549b-603f-4ade-b71d-32026392849b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.156.145.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T02:05:13.000Z",
      "valid_until": "2026-05-17T02:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T02:00:02.228Z",
      "x_nadsec_last_seen": "2026-04-15T02:00:02.228Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56046"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "***"
      ]
    },
    {
      "created": "2026-04-15T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mssqld; ports=1433; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--e96118ce-0df1-44df-a9fa-07a791085fe2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.250.81.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T02:05:13.000Z",
      "valid_until": "2026-05-17T02:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-15T01:52:52.955Z",
      "x_nadsec_last_seen": "2026-04-15T01:53:32.530Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-15T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--681db80f-d159-40e2-a842-89ba7ec46864",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.165.83.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T03:05:13.000Z",
      "valid_until": "2026-05-17T03:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-15T02:23:37.859Z",
      "x_nadsec_last_seen": "2026-04-15T02:44:30.969Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-15T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--bffd2a04-2afd-44f2-94f0-a09df72e7822",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.220.88.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T03:05:13.000Z",
      "valid_until": "2026-05-17T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T02:28:53.892Z",
      "x_nadsec_last_seen": "2026-04-15T02:28:53.892Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-15T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--3bea1757-a18a-4700-8210-f9be0f71b999",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.163.25.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T03:05:13.000Z",
      "valid_until": "2026-05-17T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-15T02:35:37.601Z",
      "x_nadsec_last_seen": "2026-04-28T01:56:05.245Z",
      "x_nadsec_ports": [
        "81",
        "1723"
      ],
      "x_nadsec_services": [
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-15T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8359; asn_org=MTS PJSC",
      "id": "indicator--f39448de-568a-422f-bda6-0cff255b4dc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '213.87.139.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T03:05:13.000Z",
      "valid_until": "2026-05-17T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-15T02:59:38.336Z",
      "x_nadsec_last_seen": "2026-04-15T03:01:45.477Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8359"
      ],
      "x_nadsec_orgs": [
        "MTS PJSC"
      ]
    },
    {
      "created": "2026-04-15T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--50d88391-164c-46c0-ae09-8dc218dee866",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '222.88.238.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T03:05:13.000Z",
      "valid_until": "2026-05-17T03:05:09.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-04-15T02:41:18.580Z",
      "x_nadsec_last_seen": "2026-04-15T02:41:29.055Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "*"
      ]
    },
    {
      "created": "2026-04-15T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=43865; asn_org=Intek-M LLC",
      "id": "indicator--12269ea2-f5e2-4c0b-98a6-a6aa70453f3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '31.135.91.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T03:05:13.000Z",
      "valid_until": "2026-05-17T03:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-15T02:10:02.612Z",
      "x_nadsec_last_seen": "2026-04-15T02:17:38.591Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "43865"
      ],
      "x_nadsec_orgs": [
        "Intek-M LLC"
      ]
    },
    {
      "created": "2026-04-15T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--34a40395-f1c2-4540-866b-6ddacdaa5cc4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T03:05:13.000Z",
      "valid_until": "2026-05-17T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T02:32:55.075Z",
      "x_nadsec_last_seen": "2026-04-15T02:32:55.075Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-15T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BD; asn=138692; asn_org=Polly IT",
      "id": "indicator--df616db8-dd75-45c2-aabb-992c3ade3c0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.136.201.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T04:05:13.000Z",
      "valid_until": "2026-05-17T04:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T03:21:12.074Z",
      "x_nadsec_last_seen": "2026-04-15T03:21:12.074Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "138692"
      ],
      "x_nadsec_orgs": [
        "Polly IT"
      ]
    },
    {
      "created": "2026-04-15T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=FR; asn=9009; asn_org=M247 Europe SRL; user(top)=r**t",
      "id": "indicator--0c3395f3-dbdd-4967-9613-f3d110bdbe77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.194.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T04:05:13.000Z",
      "valid_until": "2026-05-17T04:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-15T03:10:12.206Z",
      "x_nadsec_last_seen": "2026-04-15T03:10:18.157Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "9009"
      ],
      "x_nadsec_orgs": [
        "M247 Europe SRL"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        "",
        "s****3"
      ]
    },
    {
      "created": "2026-04-15T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--e86fd562-ac88-4a94-bf43-733c9e42b675",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.236.79.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T04:05:13.000Z",
      "valid_until": "2026-05-17T04:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-15T03:14:53.099Z",
      "x_nadsec_last_seen": "2026-04-15T03:21:57.842Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-04-15T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--77555c80-668f-412c-b5d3-3f2874f62c70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.70.158.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T04:05:13.000Z",
      "valid_until": "2026-05-17T04:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-15T03:57:41.304Z",
      "x_nadsec_last_seen": "2026-04-15T03:57:46.236Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-15T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--6891b13d-c090-4e5d-ab35-6d1732ed9083",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.80.200.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T04:05:13.000Z",
      "valid_until": "2026-05-17T04:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-15T03:08:47.142Z",
      "x_nadsec_last_seen": "2026-04-15T03:08:57.302Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-15T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d1d58aa9-cb55-4aa3-b655-d7aba0e8b0eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.235.185.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T04:05:13.000Z",
      "valid_until": "2026-05-17T04:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T03:42:50.661Z",
      "x_nadsec_last_seen": "2026-04-15T03:42:50.661Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-15T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LK; asn=9329; asn_org=Sri Lanka Telecom Internet",
      "id": "indicator--97f44f09-672a-4d8a-b687-c8bdb3595b0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '124.43.28.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T05:05:12.000Z",
      "valid_until": "2026-05-17T05:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-15T04:16:47.829Z",
      "x_nadsec_last_seen": "2026-04-15T04:18:53.764Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "9329"
      ],
      "x_nadsec_orgs": [
        "Sri Lanka Telecom Internet"
      ]
    },
    {
      "created": "2026-04-15T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BO; asn=25620; asn_org=COTAS LTDA.",
      "id": "indicator--6c88d86b-983d-4eb1-96e1-b18ee893a82b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.186.32.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T05:05:12.000Z",
      "valid_until": "2026-05-17T05:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-15T04:09:55.993Z",
      "x_nadsec_last_seen": "2026-04-15T04:12:03.302Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "25620"
      ],
      "x_nadsec_orgs": [
        "COTAS LTDA."
      ]
    },
    {
      "created": "2026-04-15T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--a5f18802-c8d2-40e9-962e-7453f4fc06c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T05:05:12.000Z",
      "valid_until": "2026-05-17T05:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T04:36:21.867Z",
      "x_nadsec_last_seen": "2026-04-15T04:36:21.867Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-15T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--efe75e83-4ee2-40e5-b9e2-a378d8301132",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T05:05:12.000Z",
      "valid_until": "2026-05-17T05:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T04:36:22.388Z",
      "x_nadsec_last_seen": "2026-04-15T04:36:22.388Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-15T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--fea7e2e9-e5ca-4963-8576-40ece88d8394",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '211.22.25.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T05:05:12.000Z",
      "valid_until": "2026-05-17T05:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-15T04:24:59.518Z",
      "x_nadsec_last_seen": "2026-04-15T04:24:59.589Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-15T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=30600; asn_org=Metronet",
      "id": "indicator--985c1fcb-f4c8-4fa7-a11a-dcc84591853c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '216.82.43.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T05:05:12.000Z",
      "valid_until": "2026-05-17T05:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-15T04:46:43.437Z",
      "x_nadsec_last_seen": "2026-04-15T04:48:49.159Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "30600"
      ],
      "x_nadsec_orgs": [
        "Metronet"
      ]
    },
    {
      "created": "2026-04-15T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--18062449-f1f4-4dbb-9a80-b8769d34e62f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '59.125.213.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T05:05:12.000Z",
      "valid_until": "2026-05-17T05:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-15T04:17:22.299Z",
      "x_nadsec_last_seen": "2026-04-15T04:17:22.359Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-15T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--50b3c854-7538-4142-ac74-f4fae5415875",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T05:05:12.000Z",
      "valid_until": "2026-05-17T05:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T04:53:31.420Z",
      "x_nadsec_last_seen": "2026-04-15T04:53:31.420Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-15T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--9ca33123-5392-449b-a8ba-0404cebfe330",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T05:05:12.000Z",
      "valid_until": "2026-05-17T05:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T04:53:31.627Z",
      "x_nadsec_last_seen": "2026-04-15T04:53:31.627Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-15T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--6235ec52-8c37-44b0-92b1-91049c4927de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.119.112.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T06:05:12.000Z",
      "valid_until": "2026-05-17T06:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-15T05:07:59.047Z",
      "x_nadsec_last_seen": "2026-04-15T05:07:59.421Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-15T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--579daa94-4ddc-4528-8f2e-dc06448e0987",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '137.184.154.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T06:05:12.000Z",
      "valid_until": "2026-05-17T06:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-15T05:15:20.119Z",
      "x_nadsec_last_seen": "2026-04-15T05:15:31.381Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-15T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=134316; asn_org=IAXN Telecom Pvt. Ltd.; user(top)=**",
      "id": "indicator--edcbbb63-c977-41fc-bc4d-e0c6ecae6a78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '157.119.215.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T06:05:12.000Z",
      "valid_until": "2026-05-17T06:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T05:45:30.762Z",
      "x_nadsec_last_seen": "2026-04-15T05:45:30.762Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134316"
      ],
      "x_nadsec_orgs": [
        "IAXN Telecom Pvt. Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-15T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--0e81553e-613d-406c-9a7e-2812cef1e099",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.234.217.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T06:05:12.000Z",
      "valid_until": "2026-05-17T06:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-15T05:34:52.949Z",
      "x_nadsec_last_seen": "2026-04-15T05:35:22.948Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-15T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TT; asn=5639; asn_org=Telecommunication Services of Trinidad and Tobago",
      "id": "indicator--65dd543e-3fe8-41d7-a423-cba8be817f7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.3.142.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T06:05:12.000Z",
      "valid_until": "2026-05-17T06:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T05:06:16.625Z",
      "x_nadsec_last_seen": "2026-04-15T05:06:16.625Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TT"
      ],
      "x_nadsec_asns": [
        "5639"
      ],
      "x_nadsec_orgs": [
        "Telecommunication Services of Trinidad and Tobago"
      ]
    },
    {
      "created": "2026-04-15T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8a305ec8-4a85-4445-a7a2-20fd03e8e60b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T06:05:12.000Z",
      "valid_until": "2026-05-17T06:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-15T05:31:18.680Z",
      "x_nadsec_last_seen": "2026-04-15T05:31:19.360Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-15T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--65c6f814-bc89-4867-90db-88f8cf8dd91c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '95.9.44.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T06:05:12.000Z",
      "valid_until": "2026-05-17T06:05:10.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-15T05:18:22.917Z",
      "x_nadsec_last_seen": "2026-04-29T05:17:12.382Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-15T08:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--c970b361-dbe5-467d-8565-edf481000c8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T08:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.174.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T08:05:14.000Z",
      "valid_until": "2026-05-17T08:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T07:05:43.194Z",
      "x_nadsec_last_seen": "2026-04-15T07:05:43.194Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-15T08:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CL; asn=16629; asn_org=CTC. CORP S.A. TELEFONICA EMPRESAS",
      "id": "indicator--10669b83-ec11-4068-af6b-bca494f21f50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T08:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '200.54.102.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T08:05:14.000Z",
      "valid_until": "2026-05-17T08:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-15T08:04:55.443Z",
      "x_nadsec_last_seen": "2026-04-15T08:12:14.631Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "16629"
      ],
      "x_nadsec_orgs": [
        "CTC. CORP S.A. TELEFONICA EMPRESAS"
      ]
    },
    {
      "created": "2026-04-15T08:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=28433; asn_org=Doornet sa de cv",
      "id": "indicator--4ad28a3f-bb4a-4183-9600-54a6bad7d4c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T08:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.174.75.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T08:05:14.000Z",
      "valid_until": "2026-05-17T08:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-15T07:58:02.650Z",
      "x_nadsec_last_seen": "2026-04-15T07:58:02.954Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "28433"
      ],
      "x_nadsec_orgs": [
        "Doornet sa de cv"
      ]
    },
    {
      "created": "2026-04-15T08:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--8798dbce-7a3c-4c9f-b79e-4e612fabbb4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T08:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '8.216.17.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T08:05:14.000Z",
      "valid_until": "2026-05-17T08:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T07:53:08.996Z",
      "x_nadsec_last_seen": "2026-04-15T07:53:08.996Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-15T09:05:50.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--23d05474-5ca2-49c0-9b3b-9d3a0f24f2ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T09:05:50.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '134.209.86.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T09:05:50.000Z",
      "valid_until": "2026-05-17T09:05:16.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T08:23:24.152Z",
      "x_nadsec_last_seen": "2026-04-15T08:23:24.152Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-15T09:05:50.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ES; asn=12357; asn_org=Vodafone Spain",
      "id": "indicator--05679f50-a584-48d5-9d1b-b7b8f531df63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T09:05:50.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.111.252.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T09:05:50.000Z",
      "valid_until": "2026-05-17T09:05:16.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-15T08:18:08.084Z",
      "x_nadsec_last_seen": "2026-04-15T08:25:19.701Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "12357"
      ],
      "x_nadsec_orgs": [
        "Vodafone Spain"
      ]
    },
    {
      "created": "2026-04-15T09:05:50.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=JO; asn=50670; asn_org=Vtel Holdings Limited/jordan Co.",
      "id": "indicator--a239f3fa-ee8b-4617-b2c8-b984aaadc55c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T09:05:50.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '81.21.9.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T09:05:50.000Z",
      "valid_until": "2026-05-17T09:05:16.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-15T08:30:04.805Z",
      "x_nadsec_last_seen": "2026-04-15T08:30:05.012Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "50670"
      ],
      "x_nadsec_orgs": [
        "Vtel Holdings Limited/jordan Co."
      ]
    },
    {
      "created": "2026-04-15T09:05:50.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PL; asn=43837; asn_org=VEGA",
      "id": "indicator--6fbe6b4f-c183-4c8e-bc6e-561a5638ed34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T09:05:50.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.198.247.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T09:05:50.000Z",
      "valid_until": "2026-05-17T09:05:16.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-15T08:20:18.458Z",
      "x_nadsec_last_seen": "2026-04-15T08:20:18.647Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "43837"
      ],
      "x_nadsec_orgs": [
        "VEGA"
      ]
    },
    {
      "created": "2026-04-15T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--0107c02d-4c06-4ea8-8aac-63ffad262f4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T10:05:13.000Z",
      "valid_until": "2026-05-17T10:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T09:34:50.360Z",
      "x_nadsec_last_seen": "2026-04-15T09:34:50.360Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-15T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--bc84c8f0-ee9f-4b03-9088-e3c2d0bfe130",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.64.104.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T10:05:13.000Z",
      "valid_until": "2026-05-17T10:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-15T09:33:08.384Z",
      "x_nadsec_last_seen": "2026-04-15T09:33:18.544Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-15T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f7dce040-5fcf-4417-b49a-15f5213b866e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.136.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T10:05:13.000Z",
      "valid_until": "2026-05-17T10:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-15T09:55:19.636Z",
      "x_nadsec_last_seen": "2026-04-15T09:55:29.988Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-15T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC; user(top)=**; pass(top)=1****6",
      "id": "indicator--c556691d-3480-4774-8081-df57d8d9192d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.28.195.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T10:05:13.000Z",
      "valid_until": "2026-05-17T10:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T09:31:43.494Z",
      "x_nadsec_last_seen": "2026-04-15T09:31:43.494Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6"
      ]
    },
    {
      "created": "2026-04-15T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--1f2c7aa9-9d7e-45a4-9ea2-191069413b9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.195.84.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T10:05:13.000Z",
      "valid_until": "2026-05-17T10:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T09:20:23.545Z",
      "x_nadsec_last_seen": "2026-04-15T09:20:23.545Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-15T11:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=DO; asn=6400; asn_org=Compania Dominicana de Telefonos S. A.",
      "id": "indicator--4aaa339e-52f5-49be-9ad6-34341f6051e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T11:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.167.36.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T11:05:04.000Z",
      "valid_until": "2026-05-17T11:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-15T10:47:10.615Z",
      "x_nadsec_last_seen": "2026-04-15T10:53:59.804Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DO"
      ],
      "x_nadsec_asns": [
        "6400"
      ],
      "x_nadsec_orgs": [
        "Compania Dominicana de Telefonos S. A."
      ]
    },
    {
      "created": "2026-04-15T11:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--64243af0-37ac-45d2-9844-ce78c33f4f69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T11:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.95.20.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T11:05:04.000Z",
      "valid_until": "2026-05-17T11:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T10:45:50.656Z",
      "x_nadsec_last_seen": "2026-04-15T10:45:50.656Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-15T11:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=NL; asn=205759; asn_org=Ghosty Networks LLC; user(top)=r**t",
      "id": "indicator--d34c9348-4dba-4c12-9370-9bc92baf5499",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T11:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.151.182.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T11:05:04.000Z",
      "valid_until": "2026-05-17T11:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-15T10:25:23.382Z",
      "x_nadsec_last_seen": "2026-04-19T16:05:01.573Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "205759"
      ],
      "x_nadsec_orgs": [
        "Ghosty Networks LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-15T11:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--3756ac87-1540-4842-88b7-c8865ccc6bd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T11:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T11:05:04.000Z",
      "valid_until": "2026-05-17T11:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T10:32:21.452Z",
      "x_nadsec_last_seen": "2026-04-15T10:32:21.452Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-15T11:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--cde2879a-ac49-4c0f-ab7b-00eb4757a4a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T11:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.100.68.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T11:05:04.000Z",
      "valid_until": "2026-05-17T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-15T10:24:29.572Z",
      "x_nadsec_last_seen": "2026-04-15T10:26:36.194Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-15T12:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TN; asn=37705; asn_org=TOPNET",
      "id": "indicator--1afbe195-620d-478d-84c2-6edcbfeaa0a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T12:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.157.124.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T12:05:15.000Z",
      "valid_until": "2026-05-17T12:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-15T11:34:16.053Z",
      "x_nadsec_last_seen": "2026-04-15T11:34:16.086Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37705"
      ],
      "x_nadsec_orgs": [
        "TOPNET"
      ]
    },
    {
      "created": "2026-04-15T12:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=266517; asn_org=M.B. SERVICOS EM TELECOMUNICACOES LTDA",
      "id": "indicator--f7079745-23db-40d4-abb4-93512f81ebc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T12:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '170.244.70.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T12:05:15.000Z",
      "valid_until": "2026-05-17T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-15T11:44:33.647Z",
      "x_nadsec_last_seen": "2026-04-15T11:44:40.025Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "266517"
      ],
      "x_nadsec_orgs": [
        "M.B. SERVICOS EM TELECOMUNICACOES LTDA"
      ]
    },
    {
      "created": "2026-04-15T12:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=KZ; asn=21299; asn_org=Kar-Tel LLC",
      "id": "indicator--29c0a96b-6568-4045-bc47-3547cb80dbda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T12:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.244.157.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T12:05:15.000Z",
      "valid_until": "2026-05-17T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-15T12:00:10.355Z",
      "x_nadsec_last_seen": "2026-04-15T12:02:17.435Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "21299"
      ],
      "x_nadsec_orgs": [
        "Kar-Tel LLC"
      ]
    },
    {
      "created": "2026-04-15T12:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--c7473862-e58d-4215-a660-149561247e70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T12:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '183.167.87.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T12:05:15.000Z",
      "valid_until": "2026-05-17T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-15T11:43:43.432Z",
      "x_nadsec_last_seen": "2026-04-15T11:46:06.077Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-15T12:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b266d92f-15fc-44d0-9c66-b87b34d86e0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T12:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.106.195.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T12:05:15.000Z",
      "valid_until": "2026-05-17T12:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T11:14:26.876Z",
      "x_nadsec_last_seen": "2026-04-15T11:14:26.876Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-15T12:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--5aed1181-07fa-410d-a805-8e7014e7dbda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T12:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.84.166.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T12:05:15.000Z",
      "valid_until": "2026-05-17T12:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-15T11:12:23.689Z",
      "x_nadsec_last_seen": "2026-04-15T11:12:33.861Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-15T12:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=OM; asn=28885; asn_org=Oman Telecommunications Company (S.A.O.G); user(top)=**",
      "id": "indicator--ba11d90f-df8f-42a6-a3e3-bcd40aa7a5a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T12:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.41.194.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T12:05:15.000Z",
      "valid_until": "2026-05-17T12:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-15T11:58:14.824Z",
      "x_nadsec_last_seen": "2026-04-15T11:58:23.487Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "OM"
      ],
      "x_nadsec_asns": [
        "28885"
      ],
      "x_nadsec_orgs": [
        "Oman Telecommunications Company (S.A.O.G)"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-15T13:05:40.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--7dd89862-dd45-4c0d-a974-3f23e60c0049",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T13:05:40.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '134.122.112.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T13:05:40.000Z",
      "valid_until": "2026-05-17T13:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T12:10:48.241Z",
      "x_nadsec_last_seen": "2026-04-15T12:10:48.241Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-15T13:05:40.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=25490; asn_org=Rostelecom",
      "id": "indicator--0edc176f-fa7c-4b58-a37e-30e27327112d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T13:05:40.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '83.239.54.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T13:05:40.000Z",
      "valid_until": "2026-05-17T13:05:10.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-15T12:25:12.713Z",
      "x_nadsec_last_seen": "2026-04-15T12:26:50.243Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25490"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-15T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mqttd; ports=1883; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--efd45722-c0ea-4d7f-820f-22a23717fda0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '128.199.182.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T14:05:02.000Z",
      "valid_until": "2026-05-17T14:05:01.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-04-15T13:12:42.058Z",
      "x_nadsec_last_seen": "2026-04-15T13:12:44.762Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-15T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--db91ed01-60c6-43d7-a84a-b383ea6f83ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.169.49.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T14:05:02.000Z",
      "valid_until": "2026-05-17T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-15T13:47:27.130Z",
      "x_nadsec_last_seen": "2026-04-16T10:57:57.826Z",
      "x_nadsec_ports": [
        "21",
        "81"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-15T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CO; asn=14080; asn_org=Telmex Colombia S.A.",
      "id": "indicator--b83a3310-e5fa-4462-ae74-2625d1d3fa54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '200.14.238.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T14:05:02.000Z",
      "valid_until": "2026-05-17T14:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-15T13:05:49.422Z",
      "x_nadsec_last_seen": "2026-04-15T13:07:54.154Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "14080"
      ],
      "x_nadsec_orgs": [
        "Telmex Colombia S.A."
      ]
    },
    {
      "created": "2026-04-15T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=mssqld; ports=1433; cc=CN; asn=4847; asn_org=China Networks Inter-Exchange; user(top)=**",
      "id": "indicator--5196be21-fa53-420d-9d02-2f7501aeed07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '218.245.1.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T14:05:02.000Z",
      "valid_until": "2026-05-17T14:05:01.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-04-15T13:23:40.331Z",
      "x_nadsec_last_seen": "2026-04-15T19:48:33.029Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4847"
      ],
      "x_nadsec_orgs": [
        "China Networks Inter-Exchange"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-15T15:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d9e7b475-cf85-4410-8b5c-e209c7bc2516",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T15:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T15:05:25.000Z",
      "valid_until": "2026-05-17T15:05:06.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T14:50:23.039Z",
      "x_nadsec_last_seen": "2026-04-15T14:50:23.039Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-15T15:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--faeb6f58-1307-4271-bc21-35d35925925e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T15:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T15:05:25.000Z",
      "valid_until": "2026-05-17T15:05:06.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-15T14:50:48.932Z",
      "x_nadsec_last_seen": "2026-04-22T14:51:59.113Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-15T15:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--ec9bf603-c7e7-4c35-b058-331ca6732142",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T15:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T15:05:25.000Z",
      "valid_until": "2026-05-17T15:05:06.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T14:50:49.439Z",
      "x_nadsec_last_seen": "2026-04-15T14:50:49.439Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-15T15:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--4c0a4259-0eb0-4e9f-8450-c146485d377b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T15:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T15:05:25.000Z",
      "valid_until": "2026-05-17T15:05:06.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-15T14:50:21.492Z",
      "x_nadsec_last_seen": "2026-04-19T05:35:54.242Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-15T15:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--da315a0d-3c18-49cd-bbd3-f125de8768c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T15:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.80.105.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T15:05:25.000Z",
      "valid_until": "2026-05-17T15:05:06.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-15T14:16:32.161Z",
      "x_nadsec_last_seen": "2026-04-15T14:16:32.510Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-15T15:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TR; asn=9121; asn_org=Turk Telekom; user(top)=**",
      "id": "indicator--4d2b306b-24f7-4d70-a730-13120db63d1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T15:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.105.136.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T15:05:25.000Z",
      "valid_until": "2026-05-17T15:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-15T14:49:55.974Z",
      "x_nadsec_last_seen": "2026-04-28T14:38:11.082Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-15T15:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=37459; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--f41364bb-ad08-4672-a3ce-db472a94b7a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T15:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T15:05:25.000Z",
      "valid_until": "2026-05-17T15:05:06.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-15T14:15:48.739Z",
      "x_nadsec_last_seen": "2026-04-15T14:15:48.745Z",
      "x_nadsec_ports": [
        "42",
        "37459"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-15T15:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--b965f4b7-8842-4600-9f71-b8b664a58ab4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T15:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T15:05:25.000Z",
      "valid_until": "2026-05-17T15:05:06.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-15T14:31:49.074Z",
      "x_nadsec_last_seen": "2026-04-20T07:52:09.228Z",
      "x_nadsec_ports": [
        "42",
        "445",
        "33927"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord",
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-15T15:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--e8b4d565-5387-45f7-ba0e-ca2901cf54ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T15:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T15:05:25.000Z",
      "valid_until": "2026-05-17T15:05:06.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T14:16:29.672Z",
      "x_nadsec_last_seen": "2026-04-15T14:16:29.672Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-15T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6091034e-0ce6-4759-96b6-9a7ecf2f2e8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.197.178.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T16:05:10.000Z",
      "valid_until": "2026-05-17T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T15:15:59.306Z",
      "x_nadsec_last_seen": "2026-04-15T15:15:59.306Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-15T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=210457; asn_org=Kyonix Networks Limited",
      "id": "indicator--9ce5aae5-1bb3-4fc3-90f5-0e88c955ae7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '144.31.151.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T16:05:10.000Z",
      "valid_until": "2026-05-17T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-15T15:55:10.935Z",
      "x_nadsec_last_seen": "2026-04-15T15:55:45.886Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "210457"
      ],
      "x_nadsec_orgs": [
        "Kyonix Networks Limited"
      ]
    },
    {
      "created": "2026-04-15T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--92f369fb-5c19-4c0e-9a7b-b81abc564c99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.176.84.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T16:05:10.000Z",
      "valid_until": "2026-05-17T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-15T15:33:49.646Z",
      "x_nadsec_last_seen": "2026-04-15T15:35:56.716Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-04-15T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--2f840cdb-e7b8-445b-9c50-9551c9926075",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.57.212.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T16:05:10.000Z",
      "valid_until": "2026-05-17T16:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-15T15:36:35.807Z",
      "x_nadsec_last_seen": "2026-04-15T15:39:21.459Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-15T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=61; services=mysqld; ports=3306; cc=FR; asn=12322; asn_org=Free SAS; user(top)=d*****n",
      "id": "indicator--d562f7e2-5410-45aa-908f-18b64283f0b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '82.64.18.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T16:05:10.000Z",
      "valid_until": "2026-05-17T16:05:09.000Z",
      "x_nadsec_event_count": 61,
      "x_nadsec_first_seen": "2026-04-15T15:50:28.556Z",
      "x_nadsec_last_seen": "2026-04-15T15:55:23.864Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "12322"
      ],
      "x_nadsec_orgs": [
        "Free SAS"
      ],
      "x_nadsec_usernames_attempted": [
        "d*****n",
        "d*********v"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-15T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BY; asn=6697; asn_org=Republican Unitary Telecommunication Enterprise Beltelecom",
      "id": "indicator--d2f1c257-33a8-4a4b-b652-f2f46edc3db2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '86.57.159.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T16:05:10.000Z",
      "valid_until": "2026-05-17T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-15T15:35:38.777Z",
      "x_nadsec_last_seen": "2026-04-15T15:37:45.156Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BY"
      ],
      "x_nadsec_asns": [
        "6697"
      ],
      "x_nadsec_orgs": [
        "Republican Unitary Telecommunication Enterprise Beltelecom"
      ]
    },
    {
      "created": "2026-04-15T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--eeccacf6-1498-47c2-8478-ec5a5cd0b490",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T18:05:05.000Z",
      "valid_until": "2026-05-17T18:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T17:22:05.072Z",
      "x_nadsec_last_seen": "2026-04-15T17:22:05.072Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-15T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0447e8d7-49e4-4ecd-94b4-e6750799496f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '159.89.53.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T18:05:05.000Z",
      "valid_until": "2026-05-17T18:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T17:24:00.563Z",
      "x_nadsec_last_seen": "2026-04-15T17:24:00.563Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-15T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--396204da-e0ff-4ef1-9f8c-dc84fc653957",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T18:05:05.000Z",
      "valid_until": "2026-05-17T18:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T17:19:17.200Z",
      "x_nadsec_last_seen": "2026-04-15T17:19:17.200Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-15T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; user(top)=**",
      "id": "indicator--00a64800-7b0d-4ff6-882d-7f054edc53b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '42.228.3.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T18:05:05.000Z",
      "valid_until": "2026-05-17T18:05:03.000Z",
      "x_nadsec_event_count": 48,
      "x_nadsec_first_seen": "2026-04-15T17:50:28.678Z",
      "x_nadsec_last_seen": "2026-04-28T08:29:51.594Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-15T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=GB; asn=201002; asn_org=PebbleHost Ltd",
      "id": "indicator--bde96bb2-b68a-470c-a777-868a2b18f1ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T18:05:05.000Z",
      "valid_until": "2026-05-17T18:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-15T17:23:59.818Z",
      "x_nadsec_last_seen": "2026-04-25T05:19:33.348Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "201002"
      ],
      "x_nadsec_orgs": [
        "PebbleHost Ltd"
      ]
    },
    {
      "created": "2026-04-15T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3e0129f8-5efa-4de1-9aec-04f56c1f36ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T18:05:05.000Z",
      "valid_until": "2026-05-17T18:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T18:02:12.430Z",
      "x_nadsec_last_seen": "2026-04-15T18:02:12.430Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-15T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d551cb5f-4e96-4cd2-9545-110e4f8b2707",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T18:05:05.000Z",
      "valid_until": "2026-05-17T18:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T18:02:44.773Z",
      "x_nadsec_last_seen": "2026-04-15T18:02:44.773Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-15T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--f3ab0309-0fdb-46e5-865c-4ed319d6604d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T18:05:05.000Z",
      "valid_until": "2026-05-17T18:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T18:02:44.966Z",
      "x_nadsec_last_seen": "2026-04-15T18:02:44.966Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-15T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--81184338-fa46-4621-9e5b-d94002e351f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T18:05:05.000Z",
      "valid_until": "2026-05-17T18:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T18:02:12.286Z",
      "x_nadsec_last_seen": "2026-04-15T18:02:12.286Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-15T19:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=JP; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--dcc0c787-3972-496f-99be-8a90d75bb601",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T19:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '139.162.70.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T19:05:16.000Z",
      "valid_until": "2026-05-17T19:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-15T18:56:04.028Z",
      "x_nadsec_last_seen": "2026-04-23T00:56:31.576Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-15T19:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--b220cef5-bd5b-4f4e-abe2-33acd7ea592d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T19:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.182.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T19:05:16.000Z",
      "valid_until": "2026-05-17T19:05:01.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-04-15T18:28:41.808Z",
      "x_nadsec_last_seen": "2026-04-18T12:10:37.578Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-15T19:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=28360; asn_org=WKVE Assessoria em Serv. de Inf. e Telecom Ltda",
      "id": "indicator--451acd4e-069a-4ecd-a517-8cefad942d4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T19:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '177.8.26.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T19:05:16.000Z",
      "valid_until": "2026-05-17T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-15T18:08:09.557Z",
      "x_nadsec_last_seen": "2026-04-15T18:10:15.785Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28360"
      ],
      "x_nadsec_orgs": [
        "WKVE Assessoria em Serv. de Inf. e Telecom Ltda"
      ]
    },
    {
      "created": "2026-04-15T19:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--47f7ff08-748a-4508-a310-5bb29cf3b411",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T19:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T19:05:16.000Z",
      "valid_until": "2026-05-17T19:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-15T18:44:46.593Z",
      "x_nadsec_last_seen": "2026-04-19T03:25:27.199Z",
      "x_nadsec_ports": [
        "21",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-15T19:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=SC; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--1747c551-180d-4a2d-9d17-73082d78f5ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T19:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.194.70.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T19:05:16.000Z",
      "valid_until": "2026-05-17T19:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-15T18:22:11.129Z",
      "x_nadsec_last_seen": "2026-04-15T18:22:55.246Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-15T19:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--94a17d3a-e1f1-48ae-9b9b-ccd3a781a501",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T19:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T19:05:16.000Z",
      "valid_until": "2026-05-17T19:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-15T19:03:32.440Z",
      "x_nadsec_last_seen": "2026-04-21T07:02:45.974Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-15T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--379ba695-7063-4fd2-bf2e-4262a9044585",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.210.22.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T20:05:02.000Z",
      "valid_until": "2026-05-17T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T19:50:34.191Z",
      "x_nadsec_last_seen": "2026-04-15T19:50:34.191Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-15T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=GB; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--4efbda66-a53b-48ce-b006-b54d5d8c9ffe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.157.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T20:05:02.000Z",
      "valid_until": "2026-05-17T20:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-15T19:05:22.380Z",
      "x_nadsec_last_seen": "2026-04-15T19:05:43.214Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-15T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--d04fe5e4-7383-4804-8ea9-1c100aea6c82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '161.35.56.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T20:05:02.000Z",
      "valid_until": "2026-05-17T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T19:48:17.710Z",
      "x_nadsec_last_seen": "2026-04-15T19:48:17.710Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-15T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--d6b05923-a248-49c7-b504-461879d82672",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.162.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T20:05:02.000Z",
      "valid_until": "2026-05-17T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T19:57:35.877Z",
      "x_nadsec_last_seen": "2026-04-15T19:57:35.877Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-15T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=ID; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--77721d07-d627-4720-8fa0-51287d01d1fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.49.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T20:05:02.000Z",
      "valid_until": "2026-05-17T20:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-15T20:00:30.519Z",
      "x_nadsec_last_seen": "2026-04-15T20:00:49.289Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-15T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=262378; asn_org=Compuservice Empreendimentos Ltda",
      "id": "indicator--ef0c1e4c-0c86-459b-9fba-9b16471c50c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '177.131.29.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T20:05:02.000Z",
      "valid_until": "2026-05-17T20:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-15T19:30:36.275Z",
      "x_nadsec_last_seen": "2026-04-15T19:37:44.150Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262378"
      ],
      "x_nadsec_orgs": [
        "Compuservice Empreendimentos Ltda"
      ]
    },
    {
      "created": "2026-04-15T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--fa667f2a-d6b1-4cec-9c1d-e9c2503e6092",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.55.88.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T20:05:02.000Z",
      "valid_until": "2026-05-17T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T19:20:45.580Z",
      "x_nadsec_last_seen": "2026-04-15T19:20:45.580Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-15T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=269820; asn_org=FULL DATA COMUNICACIONES C.A.",
      "id": "indicator--92b4bb19-b945-4a65-9619-1eeb7d375656",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '38.43.208.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T20:05:02.000Z",
      "valid_until": "2026-05-17T20:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-15T19:30:33.102Z",
      "x_nadsec_last_seen": "2026-04-15T19:32:38.731Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "269820"
      ],
      "x_nadsec_orgs": [
        "FULL DATA COMUNICACIONES C.A."
      ]
    },
    {
      "created": "2026-04-15T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--1c0afb5e-6b4b-4c39-ba10-7b94c4e3407b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T20:05:02.000Z",
      "valid_until": "2026-05-17T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T19:33:19.719Z",
      "x_nadsec_last_seen": "2026-04-15T19:33:19.719Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-15T21:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a3d2dbea-1bd5-406e-82d9-389f816659d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T21:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T21:05:12.000Z",
      "valid_until": "2026-05-17T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-15T20:49:48.200Z",
      "x_nadsec_last_seen": "2026-04-22T15:16:50.234Z",
      "x_nadsec_ports": [
        "1433",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-15T21:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PE; asn=12252; asn_org=America Movil Peru S.A.C.",
      "id": "indicator--5e8aaf00-8daf-4700-bbc5-ea466de60760",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T21:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '179.7.82.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T21:05:12.000Z",
      "valid_until": "2026-05-17T21:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-15T20:10:48.827Z",
      "x_nadsec_last_seen": "2026-04-15T20:17:58.955Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "12252"
      ],
      "x_nadsec_orgs": [
        "America Movil Peru S.A.C."
      ]
    },
    {
      "created": "2026-04-15T21:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=ftpd; ports=21; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--17ba4860-9c3e-486d-a81f-2ddeb73a1f53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T21:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.189.43.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T21:05:12.000Z",
      "valid_until": "2026-05-17T21:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-15T20:41:40.203Z",
      "x_nadsec_last_seen": "2026-04-15T20:45:51.881Z",
      "x_nadsec_ports": [
        "27017",
        "21"
      ],
      "x_nadsec_services": [
        "mongod",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-15T21:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=138871; asn_org=PT. Trans Indonesia Superkoridor",
      "id": "indicator--c0282d67-4686-4675-b524-bd125b96a731",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T21:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '202.75.28.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T21:05:12.000Z",
      "valid_until": "2026-05-17T21:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-15T20:05:14.960Z",
      "x_nadsec_last_seen": "2026-04-15T20:09:46.087Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "138871"
      ],
      "x_nadsec_orgs": [
        "PT. Trans Indonesia Superkoridor"
      ]
    },
    {
      "created": "2026-04-15T21:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--d12d9ff9-3630-45a6-8043-e9034fc29218",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T21:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T21:05:12.000Z",
      "valid_until": "2026-05-17T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T20:37:40.833Z",
      "x_nadsec_last_seen": "2026-04-15T20:37:40.833Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-15T21:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--07879074-155b-448f-8625-3bc048cf69e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T21:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T21:05:12.000Z",
      "valid_until": "2026-05-17T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T20:58:44.282Z",
      "x_nadsec_last_seen": "2026-04-15T20:58:44.282Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-15T21:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--744206bc-16a7-4584-9e1d-7eb740ea3197",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T21:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T21:05:12.000Z",
      "valid_until": "2026-05-17T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T20:58:54.648Z",
      "x_nadsec_last_seen": "2026-04-15T20:58:54.648Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-15T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=17897; asn_org=asn for Heilongjiang Provincial Net of CT; user(top)=**",
      "id": "indicator--3cfcc4ee-357c-42c1-a79d-d4a5714136f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '112.101.75.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T22:05:10.000Z",
      "valid_until": "2026-05-17T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T22:03:22.137Z",
      "x_nadsec_last_seen": "2026-04-15T22:03:22.137Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "17897"
      ],
      "x_nadsec_orgs": [
        "asn for Heilongjiang Provincial Net of CT"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-15T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--69f343a4-29e6-43cf-b25c-a097d65658e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.124.173.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T22:05:10.000Z",
      "valid_until": "2026-05-17T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T21:44:37.616Z",
      "x_nadsec_last_seen": "2026-04-15T21:44:37.616Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-15T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--d82c6ada-b262-4daa-991f-952156914ba1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.97.5.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T23:05:10.000Z",
      "valid_until": "2026-05-17T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T22:27:42.162Z",
      "x_nadsec_last_seen": "2026-04-15T22:27:42.162Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-15T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--ae027052-7b83-404d-9c64-21036a92557c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T23:05:10.000Z",
      "valid_until": "2026-05-17T23:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-15T22:14:41.788Z",
      "x_nadsec_last_seen": "2026-04-27T18:55:12.530Z",
      "x_nadsec_ports": [
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-15T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--7d9dba6b-cbcf-48a2-a454-785277d3d108",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T23:05:10.000Z",
      "valid_until": "2026-05-17T23:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-13T03:25:27.397Z",
      "x_nadsec_last_seen": "2026-04-16T08:03:17.206Z",
      "x_nadsec_ports": [
        "21",
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-04-15T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--2fb22ffe-9119-4ca0-862e-975cc4d4791d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.228.53.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T23:05:10.000Z",
      "valid_until": "2026-05-17T23:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-15T22:34:44.303Z",
      "x_nadsec_last_seen": "2026-04-15T22:35:14.304Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-15T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CA; asn=12989; asn_org=Black HOST Ltd",
      "id": "indicator--84b03f10-f707-4076-9b4f-5b3440814918",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '86.54.31.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T23:05:10.000Z",
      "valid_until": "2026-05-17T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T22:27:32.484Z",
      "x_nadsec_last_seen": "2026-04-15T22:27:32.484Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "12989"
      ],
      "x_nadsec_orgs": [
        "Black HOST Ltd"
      ]
    },
    {
      "created": "2026-04-16T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=2609; asn_org=TN-BB-AS Tunisia BackBone AS",
      "id": "indicator--c5384f8b-7201-417a-ade3-e8e3f12ae11f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.10.135.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T00:05:11.000Z",
      "valid_until": "2026-05-18T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-15T23:24:46.892Z",
      "x_nadsec_last_seen": "2026-04-15T23:26:53.046Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "2609"
      ],
      "x_nadsec_orgs": [
        "TN-BB-AS Tunisia BackBone AS"
      ]
    },
    {
      "created": "2026-04-16T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b66f61cf-0654-43c2-b3ad-449f795af908",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T00:05:11.000Z",
      "valid_until": "2026-05-18T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T23:42:34.378Z",
      "x_nadsec_last_seen": "2026-04-15T23:42:34.378Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-16T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--87b5a0c7-d754-45aa-9483-db2e5982818b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T00:05:11.000Z",
      "valid_until": "2026-05-18T00:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-15T23:51:27.547Z",
      "x_nadsec_last_seen": "2026-04-15T23:51:28.774Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-16T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--0a6811e3-001b-4043-94b3-334846186134",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T00:05:11.000Z",
      "valid_until": "2026-05-18T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-15T23:11:19.166Z",
      "x_nadsec_last_seen": "2026-04-15T23:11:19.166Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-16T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=GB; asn=201002; asn_org=PebbleHost Ltd",
      "id": "indicator--c185f73f-694f-45b4-a937-cda405f8ce5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.11.182.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T00:05:11.000Z",
      "valid_until": "2026-05-18T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-16T00:00:10.089Z",
      "x_nadsec_last_seen": "2026-04-16T00:00:26.072Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "201002"
      ],
      "x_nadsec_orgs": [
        "PebbleHost Ltd"
      ]
    },
    {
      "created": "2026-04-16T01:05:35.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--1593592c-6a05-4805-93e0-d922e3e9d749",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T01:05:35.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.190.246.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T01:05:35.000Z",
      "valid_until": "2026-05-18T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T00:37:22.868Z",
      "x_nadsec_last_seen": "2026-04-16T00:37:22.868Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-16T01:05:35.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--514d225d-c059-42f2-a6b5-cb28e9eae9be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T01:05:35.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.131.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T01:05:35.000Z",
      "valid_until": "2026-05-18T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T00:46:55.971Z",
      "x_nadsec_last_seen": "2026-04-16T00:46:55.971Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-16T01:05:35.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--89da240b-e8cc-4894-9028-f2cc8a838996",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T01:05:35.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.207.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T01:05:35.000Z",
      "valid_until": "2026-05-18T01:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-16T00:46:03.419Z",
      "x_nadsec_last_seen": "2026-04-16T00:46:48.516Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-16T01:05:35.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--3354585d-026f-475b-b1be-e4eac16cf16d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T01:05:35.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.89.218.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T01:05:35.000Z",
      "valid_until": "2026-05-18T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T01:01:56.158Z",
      "x_nadsec_last_seen": "2026-04-16T01:01:56.158Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-16T01:05:35.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--1d463952-667b-4259-83c5-de0284fbcc17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T01:05:35.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.62.197.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T01:05:35.000Z",
      "valid_until": "2026-05-18T01:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-16T00:46:37.102Z",
      "x_nadsec_last_seen": "2026-04-29T13:38:33.760Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-04-16T01:05:35.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--442981fc-a85d-44f2-8608-8aa373dd0fc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T01:05:35.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '8.216.13.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T01:05:35.000Z",
      "valid_until": "2026-05-18T01:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-16T00:27:51.007Z",
      "x_nadsec_last_seen": "2026-04-16T00:28:14.787Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-16T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--db6e29cf-f35b-40c6-bab7-c5c801aba30d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T02:05:11.000Z",
      "valid_until": "2026-05-18T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T01:07:24.370Z",
      "x_nadsec_last_seen": "2026-04-16T01:07:24.370Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-16T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--923d19fe-712a-4a0d-b60a-c5d6be9a47e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '210.212.233.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T02:05:11.000Z",
      "valid_until": "2026-05-18T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T01:38:17.208Z",
      "x_nadsec_last_seen": "2026-04-16T01:38:17.208Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-04-16T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--adaf91a8-56a5-4a05-b894-0973b2aaf90a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '116.178.129.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T03:05:10.000Z",
      "valid_until": "2026-05-18T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T02:25:37.594Z",
      "x_nadsec_last_seen": "2026-04-16T02:25:37.594Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-04-16T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=NG; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--ff9acfa1-6970-4bb4-989f-e56b6ab5a200",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.141.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T03:05:10.000Z",
      "valid_until": "2026-05-18T03:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-16T02:29:23.881Z",
      "x_nadsec_last_seen": "2026-04-16T02:30:13.481Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-16T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--823d94f7-ab3e-4c98-b60b-23003e91ffa8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T03:05:10.000Z",
      "valid_until": "2026-05-18T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T02:55:52.785Z",
      "x_nadsec_last_seen": "2026-04-16T02:55:52.785Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-16T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--2bba9d1c-d5fc-4539-9122-ff40317401ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T03:05:10.000Z",
      "valid_until": "2026-05-18T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-12T00:59:23.414Z",
      "x_nadsec_last_seen": "2026-04-30T13:40:27.080Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135"
      ],
      "x_nadsec_services": [
        "ftpd",
        "epmapper",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-16T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--ee9b3f54-2549-4b79-8996-388322d80c2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.41.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T04:05:10.000Z",
      "valid_until": "2026-05-18T04:05:08.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-16T03:27:25.657Z",
      "x_nadsec_last_seen": "2026-04-16T03:28:13.346Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-16T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--ee429386-7130-44f7-ac14-0f781c78abf2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.186.168.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T04:05:10.000Z",
      "valid_until": "2026-05-18T04:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-16T03:06:37.369Z",
      "x_nadsec_last_seen": "2026-04-16T03:08:42.254Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-04-16T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--6835e72c-6bea-49c4-9430-50478c37af8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '44.215.219.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T04:05:10.000Z",
      "valid_until": "2026-05-18T04:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-16T03:23:13.310Z",
      "x_nadsec_last_seen": "2026-04-19T11:36:23.299Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-16T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--a9d768c8-d53b-40eb-83b2-8a68fd9b7574",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T04:05:10.000Z",
      "valid_until": "2026-05-18T04:05:08.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-16T03:47:44.022Z",
      "x_nadsec_last_seen": "2026-04-16T03:48:24.292Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-04-16T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=SC; asn=212552; asn_org=BitCommand LLC; user(top)=**; pass(top)=***",
      "id": "indicator--51679603-b334-4388-a985-ff79f2725d6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.195.250.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T04:05:10.000Z",
      "valid_until": "2026-05-18T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T03:37:32.276Z",
      "x_nadsec_last_seen": "2026-04-16T03:37:32.276Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "212552"
      ],
      "x_nadsec_orgs": [
        "BitCommand LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "***"
      ]
    },
    {
      "created": "2026-04-16T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--6d9aa3bb-48b2-4d30-8cd9-d483f6c43236",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T04:05:10.000Z",
      "valid_until": "2026-05-18T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T03:31:58.013Z",
      "x_nadsec_last_seen": "2026-04-16T03:31:58.013Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-16T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--da6a0f4a-8aa7-4bd0-ba67-a60c1de5e948",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '101.36.108.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T05:05:10.000Z",
      "valid_until": "2026-05-18T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T04:40:44.895Z",
      "x_nadsec_last_seen": "2026-04-16T04:40:44.895Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-16T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=116; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--9b9c2580-29e8-43ab-8e49-fa66a4c7f69b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.191.116.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T05:05:10.000Z",
      "valid_until": "2026-05-18T05:05:09.000Z",
      "x_nadsec_event_count": 116,
      "x_nadsec_first_seen": "2026-04-16T04:54:14.879Z",
      "x_nadsec_last_seen": "2026-04-16T04:58:02.314Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-16T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KG; asn=12997; asn_org=OJSC Kyrgyztelecom",
      "id": "indicator--ad000853-72c5-4a33-b487-557e5ad60bb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '213.145.157.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T05:05:10.000Z",
      "valid_until": "2026-05-18T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-16T04:23:35.036Z",
      "x_nadsec_last_seen": "2026-04-16T04:25:42.221Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KG"
      ],
      "x_nadsec_asns": [
        "12997"
      ],
      "x_nadsec_orgs": [
        "OJSC Kyrgyztelecom"
      ]
    },
    {
      "created": "2026-04-16T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=55313; asn_org=Hanel Communication JSC",
      "id": "indicator--b16872ed-3523-46bb-8d03-d598d0cc3787",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '27.118.25.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T05:05:10.000Z",
      "valid_until": "2026-05-18T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-16T04:50:54.334Z",
      "x_nadsec_last_seen": "2026-04-16T04:50:54.455Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "55313"
      ],
      "x_nadsec_orgs": [
        "Hanel Communication JSC"
      ]
    },
    {
      "created": "2026-04-16T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=147185; asn_org=INFYNIX DATA SERVICES PRIVATE LIMITED",
      "id": "indicator--d0b4fa51-59d8-4194-bfd6-8527355aa3b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '38.183.107.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T05:05:10.000Z",
      "valid_until": "2026-05-18T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-16T04:52:38.295Z",
      "x_nadsec_last_seen": "2026-04-16T04:52:43.277Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "147185"
      ],
      "x_nadsec_orgs": [
        "INFYNIX DATA SERVICES PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-04-16T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--47a16119-fb6c-4ab6-842a-247316e74d1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T05:05:10.000Z",
      "valid_until": "2026-05-18T05:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-16T04:25:39.024Z",
      "x_nadsec_last_seen": "2026-04-30T20:52:28.529Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-16T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=FR; asn=12322; asn_org=Free SAS; user(top)=r**t",
      "id": "indicator--090dee18-e1ec-4d7e-a513-0b8bff423821",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '82.67.201.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T05:05:10.000Z",
      "valid_until": "2026-05-18T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-16T04:47:32.484Z",
      "x_nadsec_last_seen": "2026-04-16T15:38:31.825Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "12322"
      ],
      "x_nadsec_orgs": [
        "Free SAS"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        "",
        "s****3"
      ]
    },
    {
      "created": "2026-04-16T07:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--da78b1c3-24c7-4fe6-a46b-438cbf8d6911",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T07:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '101.36.106.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T07:05:12.000Z",
      "valid_until": "2026-05-18T07:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T06:49:45.584Z",
      "x_nadsec_last_seen": "2026-04-16T06:49:45.584Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-16T07:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--fc0b66ce-b944-4f4e-b2de-5523c143b718",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T07:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.193.38.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T07:05:12.000Z",
      "valid_until": "2026-05-18T07:05:08.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-04-16T06:28:39.304Z",
      "x_nadsec_last_seen": "2026-04-18T23:41:41.344Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-16T07:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--4037f2bb-b33a-49a5-81f8-237168a72cd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T07:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.133.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T07:05:12.000Z",
      "valid_until": "2026-05-18T07:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-16T06:19:59.244Z",
      "x_nadsec_last_seen": "2026-04-16T06:20:09.249Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-16T07:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--5056c6ae-ce2e-4820-9f64-32854e4a7a91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T07:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '159.223.159.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T07:05:12.000Z",
      "valid_until": "2026-05-18T07:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T06:12:43.397Z",
      "x_nadsec_last_seen": "2026-04-16T06:12:43.397Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-16T07:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=ID; asn=152790; asn_org=CV Arunika Investama; user(top)=**",
      "id": "indicator--cf4a1081-6cad-4bd2-b4a2-e92190518035",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T07:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '160.20.105.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T07:05:12.000Z",
      "valid_until": "2026-05-18T07:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-16T06:56:23.917Z",
      "x_nadsec_last_seen": "2026-04-30T11:29:43.443Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "152790"
      ],
      "x_nadsec_orgs": [
        "CV Arunika Investama"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "",
        "1****6"
      ]
    },
    {
      "created": "2026-04-16T07:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--21074945-e39f-4682-a101-86e7a9947d8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T07:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '2.63.250.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T07:05:12.000Z",
      "valid_until": "2026-05-18T07:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-16T06:06:53.502Z",
      "x_nadsec_last_seen": "2026-04-16T06:06:53.835Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-16T07:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--183d1a2b-f451-4c4d-b26e-64e4b19b1468",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T07:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T07:05:12.000Z",
      "valid_until": "2026-05-18T07:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-16T06:37:35.781Z",
      "x_nadsec_last_seen": "2026-04-22T09:32:02.301Z",
      "x_nadsec_ports": [
        "445",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-16T07:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--0b941f9d-076a-4fd0-9664-79149b4a0c61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T07:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '86.98.49.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T07:05:12.000Z",
      "valid_until": "2026-05-18T07:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-16T06:53:46.247Z",
      "x_nadsec_last_seen": "2026-04-16T06:55:51.186Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ]
    },
    {
      "created": "2026-04-16T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=CN; asn=4808; asn_org=China Unicom Beijing Province Network",
      "id": "indicator--81b50391-9d27-44a6-9dda-7613deba14dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '106.75.13.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T08:05:12.000Z",
      "valid_until": "2026-05-18T08:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-16T07:20:45.000Z",
      "x_nadsec_last_seen": "2026-04-16T07:21:01.037Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4808"
      ],
      "x_nadsec_orgs": [
        "China Unicom Beijing Province Network"
      ]
    },
    {
      "created": "2026-04-16T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--506fe066-f4a3-4a90-9c8b-b2250876e9a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '110.78.143.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T08:05:12.000Z",
      "valid_until": "2026-05-18T08:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-16T07:06:47.976Z",
      "x_nadsec_last_seen": "2026-04-16T07:13:15.124Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-04-16T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--98ee8471-a8b1-43f1-a553-64e1df1622af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '122.185.110.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T08:05:12.000Z",
      "valid_until": "2026-05-18T08:05:10.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-16T07:16:26.733Z",
      "x_nadsec_last_seen": "2026-04-16T07:16:52.005Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-04-16T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--be5eacaa-6666-447a-859a-4233520a3697",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.97.26.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T08:05:12.000Z",
      "valid_until": "2026-05-18T08:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T07:09:41.462Z",
      "x_nadsec_last_seen": "2026-04-16T07:09:41.462Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-16T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=MN; asn=45204; asn_org=GEMNET LLC",
      "id": "indicator--cf5f2317-7e04-461f-ba9a-fc2242fef800",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '180.149.125.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T08:05:12.000Z",
      "valid_until": "2026-05-18T08:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T07:35:36.891Z",
      "x_nadsec_last_seen": "2026-04-16T07:35:36.891Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "45204"
      ],
      "x_nadsec_orgs": [
        "GEMNET LLC"
      ]
    },
    {
      "created": "2026-04-16T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=NL; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--cded6b0a-f596-47f4-bb89-8d1d9360182c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.50.16.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T08:05:12.000Z",
      "valid_until": "2026-05-18T08:05:10.000Z",
      "x_nadsec_event_count": 231,
      "x_nadsec_first_seen": "2026-04-16T07:53:21.041Z",
      "x_nadsec_last_seen": "2026-04-30T07:26:00.138Z",
      "x_nadsec_ports": [
        "21",
        "1723",
        "81",
        "3306",
        "1433",
        "445",
        "1883",
        "27017",
        "135"
      ],
      "x_nadsec_services": [
        "ftpd",
        "pptpd",
        "httpd",
        "mysqld",
        "mssqld",
        "mongod",
        "mqttd",
        "smbd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-04-16T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--9a09aa7a-f8dd-41fe-a59d-8bc83242f6eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T08:05:12.000Z",
      "valid_until": "2026-05-18T08:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-16T07:42:31.407Z",
      "x_nadsec_last_seen": "2026-04-25T23:33:27.370Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-16T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--76a13089-7004-4317-91a3-989c7679ca46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.167.99.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T09:05:07.000Z",
      "valid_until": "2026-05-18T09:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-16T08:45:41.448Z",
      "x_nadsec_last_seen": "2026-04-16T08:52:08.939Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-16T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--4bc6866c-c3c9-4ec6-a885-bd01ef060446",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.213.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T09:05:07.000Z",
      "valid_until": "2026-05-18T09:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T08:10:51.230Z",
      "x_nadsec_last_seen": "2026-04-16T08:10:51.230Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-16T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--d3e2c5d1-cc21-4428-991e-919b940b7a7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.173.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T09:05:07.000Z",
      "valid_until": "2026-05-18T09:05:00.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-16T08:23:48.433Z",
      "x_nadsec_last_seen": "2026-04-16T08:24:33.295Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-16T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--bf3c24ca-bd67-4bb3-af86-512b0d4bcac1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '222.175.182.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T09:05:07.000Z",
      "valid_until": "2026-05-18T09:05:00.000Z",
      "x_nadsec_event_count": 45,
      "x_nadsec_first_seen": "2026-04-16T08:37:00.783Z",
      "x_nadsec_last_seen": "2026-04-16T08:40:24.610Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-16T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--17b1284c-f040-4613-afcb-7ab21d9579aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T09:05:07.000Z",
      "valid_until": "2026-05-18T09:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-09T17:34:52.537Z",
      "x_nadsec_last_seen": "2026-04-16T08:33:44.917Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-16T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--4cfbed3f-9213-4ff2-8772-f4306cb1f465",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T09:05:07.000Z",
      "valid_until": "2026-05-18T09:05:00.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-16T08:33:48.632Z",
      "x_nadsec_last_seen": "2026-04-28T00:13:56.050Z",
      "x_nadsec_ports": [
        "445",
        "81",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "httpd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-04-16T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=70; services=mysqld; ports=3306; cc=IN; asn=135175; asn_org=Facts Online Pvt Ltd; user(top)=r**t",
      "id": "indicator--5d0b0d66-81cc-4e69-89d0-96ab04627ad9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.61.76.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T10:05:11.000Z",
      "valid_until": "2026-05-18T10:05:09.000Z",
      "x_nadsec_event_count": 70,
      "x_nadsec_first_seen": "2026-04-16T09:39:53.720Z",
      "x_nadsec_last_seen": "2026-04-16T09:40:39.083Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135175"
      ],
      "x_nadsec_orgs": [
        "Facts Online Pvt Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-16T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4f324b61-93e0-48d3-9d87-48026d2f0d87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.202.118.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T10:05:11.000Z",
      "valid_until": "2026-05-18T10:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-16T09:48:36.063Z",
      "x_nadsec_last_seen": "2026-04-16T09:48:36.815Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-16T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TR; asn=213570; asn_org=Alperen Karabiyik",
      "id": "indicator--2b804ddb-f7b0-4f38-bad0-6746bbe33948",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '31.58.236.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T10:05:11.000Z",
      "valid_until": "2026-05-18T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-16T09:45:37.786Z",
      "x_nadsec_last_seen": "2026-04-16T09:45:38.604Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "213570"
      ],
      "x_nadsec_orgs": [
        "Alperen Karabiyik"
      ]
    },
    {
      "created": "2026-04-16T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--db329ae1-50ed-429d-870f-9396506efeb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T10:05:11.000Z",
      "valid_until": "2026-05-18T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-16T09:50:03.063Z",
      "x_nadsec_last_seen": "2026-04-16T09:50:03.467Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-16T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--22bc5897-5bdb-4720-b4e9-90dc03f8452d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T10:05:11.000Z",
      "valid_until": "2026-05-18T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T09:49:39.668Z",
      "x_nadsec_last_seen": "2026-04-16T09:49:39.668Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-16T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--b6a78597-9b00-472b-be3b-9916517e9286",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T10:05:11.000Z",
      "valid_until": "2026-05-18T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T09:49:39.888Z",
      "x_nadsec_last_seen": "2026-04-16T09:49:39.888Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-16T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=56042; asn_org=China Mobile communications corporation",
      "id": "indicator--9e78cdfb-3e68-4013-b1be-fef92e551c4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '111.53.193.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T11:05:10.000Z",
      "valid_until": "2026-05-18T11:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-16T10:47:12.184Z",
      "x_nadsec_last_seen": "2026-04-16T10:53:46.752Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56042"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-04-16T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--8eca6ffb-91f6-4b2e-b7be-607d2c40a86c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.183.17.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T11:05:10.000Z",
      "valid_until": "2026-05-18T11:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-16T10:29:25.241Z",
      "x_nadsec_last_seen": "2026-04-16T10:36:33.595Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-16T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=70; services=mysqld; ports=3306; cc=BR; asn=267121; asn_org=ATPlus Telecom; user(top)=r**t",
      "id": "indicator--f4752e5a-3ef8-4cd6-81f7-d8a42198c84d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '187.84.150.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T11:05:10.000Z",
      "valid_until": "2026-05-18T11:05:08.000Z",
      "x_nadsec_event_count": 83,
      "x_nadsec_first_seen": "2026-04-16T10:25:40.353Z",
      "x_nadsec_last_seen": "2026-04-17T09:20:58.784Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "267121"
      ],
      "x_nadsec_orgs": [
        "ATPlus Telecom"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-16T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=GB; asn=396982; asn_org=Google LLC",
      "id": "indicator--186a8949-4ef5-4d82-8158-a375d9929765",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.203.210.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T11:05:10.000Z",
      "valid_until": "2026-05-18T11:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T10:24:41.418Z",
      "x_nadsec_last_seen": "2026-04-16T10:24:41.418Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-16T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=39; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--ee2de3a3-2a4c-4d89-bb39-b2d05fac3195",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.33.190.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T11:05:10.000Z",
      "valid_until": "2026-05-18T11:05:08.000Z",
      "x_nadsec_event_count": 3111,
      "x_nadsec_first_seen": "2026-04-16T10:43:14.110Z",
      "x_nadsec_last_seen": "2026-04-16T12:26:09.276Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-16T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=mongod; ports=27017; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--18b4d64b-c946-418c-bae9-a102d25119cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T11:05:10.000Z",
      "valid_until": "2026-05-18T11:05:08.000Z",
      "x_nadsec_event_count": 16,
      "x_nadsec_first_seen": "2026-04-16T10:34:19.274Z",
      "x_nadsec_last_seen": "2026-04-24T22:00:21.719Z",
      "x_nadsec_ports": [
        "27017",
        "21"
      ],
      "x_nadsec_services": [
        "mongod",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-04-16T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=BG; asn=200019; asn_org=Alexhost Srl",
      "id": "indicator--f6f983e7-79a7-4b90-8bba-ea4901a553c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.48.248.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T12:05:11.000Z",
      "valid_until": "2026-05-18T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T12:03:53.406Z",
      "x_nadsec_last_seen": "2026-04-16T12:03:53.406Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "200019"
      ],
      "x_nadsec_orgs": [
        "Alexhost Srl"
      ]
    },
    {
      "created": "2026-04-16T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--4be0ae6a-e9a4-45f2-ac26-f80b302ff962",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T12:05:11.000Z",
      "valid_until": "2026-05-18T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T12:02:05.520Z",
      "x_nadsec_last_seen": "2026-04-16T12:02:05.520Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-16T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=IN; asn=133661; asn_org=Netplus Broadband Services Private Limited",
      "id": "indicator--c8219fe1-8e76-4cbf-b236-1b63b9871bc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.217.116.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T13:05:03.000Z",
      "valid_until": "2026-05-18T13:05:01.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-04-16T12:42:52.976Z",
      "x_nadsec_last_seen": "2026-04-16T12:43:11.485Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133661"
      ],
      "x_nadsec_orgs": [
        "Netplus Broadband Services Private Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1*******9"
      ]
    },
    {
      "created": "2026-04-16T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2421; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--ed801a98-08bb-4882-b84b-14d9af536dd3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '117.204.23.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T13:05:03.000Z",
      "valid_until": "2026-05-18T13:05:01.000Z",
      "x_nadsec_event_count": 2421,
      "x_nadsec_first_seen": "2026-04-16T12:08:35.949Z",
      "x_nadsec_last_seen": "2026-04-16T12:46:04.172Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-04-16T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=240; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--1e8ba249-2214-4792-a442-29b77f116282",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '117.204.23.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T13:05:03.000Z",
      "valid_until": "2026-05-18T13:05:01.000Z",
      "x_nadsec_event_count": 240,
      "x_nadsec_first_seen": "2026-04-16T12:46:14.956Z",
      "x_nadsec_last_seen": "2026-04-16T12:49:36.372Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-04-16T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--c562fba9-f600-4509-8334-a3fd2d0886ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.182.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T13:05:03.000Z",
      "valid_until": "2026-05-18T13:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-16T12:59:04.840Z",
      "x_nadsec_last_seen": "2026-04-20T16:21:28.387Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-16T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--0f33f29e-14b2-49de-bade-13032de20d8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.163.1.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T13:05:03.000Z",
      "valid_until": "2026-05-18T13:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-16T12:32:59.737Z",
      "x_nadsec_last_seen": "2026-04-16T12:33:00.042Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-16T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--5a8a78e7-0036-44a8-aff3-6c606256a2d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T13:05:03.000Z",
      "valid_until": "2026-05-18T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T12:37:50.190Z",
      "x_nadsec_last_seen": "2026-04-16T12:37:50.190Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-16T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IT; asn=3269; asn_org=TIM",
      "id": "indicator--572e95c2-c7be-4a9a-a960-1d69a4968d48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.27.191.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T13:05:03.000Z",
      "valid_until": "2026-05-18T13:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-16T13:03:52.030Z",
      "x_nadsec_last_seen": "2026-04-16T13:10:50.477Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "3269"
      ],
      "x_nadsec_orgs": [
        "TIM"
      ]
    },
    {
      "created": "2026-04-16T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=LK; asn=9329; asn_org=Sri Lanka Telecom Internet; user(top)=**",
      "id": "indicator--092eaacf-ea8a-40e3-91fa-3ea31833a6fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '124.43.179.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T14:05:11.000Z",
      "valid_until": "2026-05-18T14:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T13:22:45.591Z",
      "x_nadsec_last_seen": "2026-04-16T13:22:45.591Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "9329"
      ],
      "x_nadsec_orgs": [
        "Sri Lanka Telecom Internet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-16T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--ea6fa25f-39c7-40c1-9de6-ef3cde78eed2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T14:05:11.000Z",
      "valid_until": "2026-05-18T14:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-16T13:39:36.693Z",
      "x_nadsec_last_seen": "2026-04-27T11:54:38.747Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-04-16T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--a53ec823-0bfa-4aff-a5ca-fb5564eea532",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.205.68.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T14:05:11.000Z",
      "valid_until": "2026-05-18T14:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T13:57:51.038Z",
      "x_nadsec_last_seen": "2026-04-16T13:57:51.038Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-16T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--37ae065c-4338-4a81-b2df-f98eea18f855",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T14:05:11.000Z",
      "valid_until": "2026-05-18T14:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-16T13:14:48.006Z",
      "x_nadsec_last_seen": "2026-04-23T13:18:34.587Z",
      "x_nadsec_ports": [
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-16T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--568d6fd0-0c16-494d-9205-3633aa52369d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T14:05:11.000Z",
      "valid_until": "2026-05-18T14:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T13:32:25.894Z",
      "x_nadsec_last_seen": "2026-04-16T13:32:25.894Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-16T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--b264fe39-9769-4fb6-ac0c-f60ccfd65736",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.194.251.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T15:05:10.000Z",
      "valid_until": "2026-05-18T15:05:08.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-16T14:24:19.683Z",
      "x_nadsec_last_seen": "2026-04-16T14:25:03.750Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-16T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--9dccdd5c-6537-43f2-a60c-c530277cd60b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.225.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T15:05:10.000Z",
      "valid_until": "2026-05-18T15:05:08.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-16T14:07:23.285Z",
      "x_nadsec_last_seen": "2026-04-16T14:08:08.412Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-16T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--3b91acea-20ae-4ef5-8449-b423c2a225fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T15:05:10.000Z",
      "valid_until": "2026-05-18T15:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T15:02:50.817Z",
      "x_nadsec_last_seen": "2026-04-16T15:02:50.817Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-16T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DE; asn=3320; asn_org=Deutsche Telekom AG",
      "id": "indicator--357b747a-3123-40a5-9712-71aca078db8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '217.86.253.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T15:05:10.000Z",
      "valid_until": "2026-05-18T15:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-16T14:07:25.784Z",
      "x_nadsec_last_seen": "2026-04-16T14:09:32.394Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "3320"
      ],
      "x_nadsec_orgs": [
        "Deutsche Telekom AG"
      ]
    },
    {
      "created": "2026-04-16T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=NL; asn=205759; asn_org=Ghosty Networks LLC; user(top)=r**t",
      "id": "indicator--10c43ed6-870d-47bd-a497-4e72677f18a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.151.182.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T15:05:10.000Z",
      "valid_until": "2026-05-18T15:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T14:34:47.960Z",
      "x_nadsec_last_seen": "2026-04-16T14:34:47.960Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "205759"
      ],
      "x_nadsec_orgs": [
        "Ghosty Networks LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-16T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=199634; asn_org=Yedinaya Setevaya Kompaniya Ltd",
      "id": "indicator--56eae437-1f42-44a8-b2c3-27445083f518",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '62.122.211.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T15:05:10.000Z",
      "valid_until": "2026-05-18T15:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-16T14:31:06.840Z",
      "x_nadsec_last_seen": "2026-04-16T14:33:13.333Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "199634"
      ],
      "x_nadsec_orgs": [
        "Yedinaya Setevaya Kompaniya Ltd"
      ]
    },
    {
      "created": "2026-04-16T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--be6a867f-8da0-446f-8208-dfeccd9a1fc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.165.64.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T16:05:10.000Z",
      "valid_until": "2026-05-18T16:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-16T15:33:40.587Z",
      "x_nadsec_last_seen": "2026-04-16T15:35:46.746Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-16T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--fb59e99e-f68f-4939-b0c7-8a18a7434d6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.90.115.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T16:05:10.000Z",
      "valid_until": "2026-05-18T16:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T15:21:16.813Z",
      "x_nadsec_last_seen": "2026-04-16T15:21:16.813Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-04-16T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--4108de56-5e88-42ad-9df7-00cf06b5ec27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.182.250.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T16:05:10.000Z",
      "valid_until": "2026-05-18T16:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-16T15:57:32.577Z",
      "x_nadsec_last_seen": "2026-04-16T15:57:35.727Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-16T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--61762fe0-957b-40e6-a104-c15d2a262349",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.135.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T16:05:10.000Z",
      "valid_until": "2026-05-18T16:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T15:35:37.701Z",
      "x_nadsec_last_seen": "2026-04-16T15:35:37.701Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-16T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--9f767ce3-84d2-486c-85a4-d646ed74b56d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.96.22.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T16:05:10.000Z",
      "valid_until": "2026-05-18T16:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-16T15:32:05.246Z",
      "x_nadsec_last_seen": "2026-04-17T00:04:01.041Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-04-16T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--2eb4ea58-51f6-48ff-84c6-6dd2e4f7fedb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T16:05:10.000Z",
      "valid_until": "2026-05-18T16:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-08T14:12:20.659Z",
      "x_nadsec_last_seen": "2026-04-30T01:01:41.593Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135",
        "1723"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-16T17:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--a984b872-95a1-455d-9c2c-332d97830e86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T17:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T17:05:06.000Z",
      "valid_until": "2026-05-18T17:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T16:46:27.860Z",
      "x_nadsec_last_seen": "2026-04-16T16:46:27.860Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-16T17:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--47e2a0e1-1286-42ed-a2d6-6f346ef20c7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T17:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T17:05:06.000Z",
      "valid_until": "2026-05-18T17:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T16:46:17.601Z",
      "x_nadsec_last_seen": "2026-04-16T16:46:17.601Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-16T17:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--5963635c-4ff2-4604-a6d5-2526ce7751a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T17:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.77.219.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T17:05:06.000Z",
      "valid_until": "2026-05-18T17:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-16T16:58:58.046Z",
      "x_nadsec_last_seen": "2026-04-22T00:36:41.544Z",
      "x_nadsec_ports": [
        "3306",
        "21"
      ],
      "x_nadsec_services": [
        "mysqld",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t",
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "",
        "a********@"
      ]
    },
    {
      "created": "2026-04-16T17:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--f0f89929-7e42-4d67-a724-a44df9fab1ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T17:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T17:05:06.000Z",
      "valid_until": "2026-05-18T17:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T17:02:29.122Z",
      "x_nadsec_last_seen": "2026-04-16T17:02:29.122Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-04-16T17:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--14c0a172-ddac-44c8-b396-5ddf960e374b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T17:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.240.192.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T17:05:06.000Z",
      "valid_until": "2026-05-18T17:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T16:06:44.951Z",
      "x_nadsec_last_seen": "2026-04-16T16:06:44.951Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-04-16T17:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--2027d027-5d41-47ed-8c3f-fc9183f71dfa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T17:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '8.211.15.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T17:05:06.000Z",
      "valid_until": "2026-05-18T17:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T16:20:13.122Z",
      "x_nadsec_last_seen": "2026-04-16T16:20:13.122Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-16T17:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--7121adad-2c08-49a1-a967-798de977b2de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T17:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T17:05:06.000Z",
      "valid_until": "2026-05-18T17:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T16:56:56.243Z",
      "x_nadsec_last_seen": "2026-04-16T16:56:56.243Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-16T17:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--526f3a43-20d1-4973-aa2c-a8c51123cc05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T17:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T17:05:06.000Z",
      "valid_until": "2026-05-18T17:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T16:57:24.752Z",
      "x_nadsec_last_seen": "2026-04-16T16:57:24.752Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-16T17:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d6bfb613-1de8-451a-8cf2-accaf6e90ae4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T17:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T17:05:06.000Z",
      "valid_until": "2026-05-18T17:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-16T16:57:24.115Z",
      "x_nadsec_last_seen": "2026-04-27T06:44:35.016Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-16T17:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3811e9e9-7290-45fe-a0d2-99a523c61266",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T17:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T17:05:06.000Z",
      "valid_until": "2026-05-18T17:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T16:56:56.619Z",
      "x_nadsec_last_seen": "2026-04-16T16:56:56.619Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-16T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrord; ports=42; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--72a0b69a-5406-4971-bf0d-54b13ab3b954",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.133.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T18:05:10.000Z",
      "valid_until": "2026-05-18T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-16T17:33:51.009Z",
      "x_nadsec_last_seen": "2026-04-16T17:33:51.012Z",
      "x_nadsec_ports": [
        "42",
        "45437"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-16T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--a8661e6f-167c-475e-9e2b-ac76b81e5b54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T18:05:10.000Z",
      "valid_until": "2026-05-18T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-16T17:11:45.005Z",
      "x_nadsec_last_seen": "2026-04-16T17:12:15.004Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-16T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=MN; asn=45204; asn_org=GEMNET LLC",
      "id": "indicator--b79cde4a-7520-486f-a6e2-265097065b4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '180.149.126.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T18:05:10.000Z",
      "valid_until": "2026-05-18T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T17:06:18.767Z",
      "x_nadsec_last_seen": "2026-04-16T17:06:18.767Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "45204"
      ],
      "x_nadsec_orgs": [
        "GEMNET LLC"
      ]
    },
    {
      "created": "2026-04-16T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=28656; asn_org=BTT TELECOMUNICACOES S.A.",
      "id": "indicator--2da1b27f-59fa-4a86-a814-f750e4f71fcf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.52.72.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T18:05:10.000Z",
      "valid_until": "2026-05-18T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-16T17:36:36.198Z",
      "x_nadsec_last_seen": "2026-04-16T17:36:36.290Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28656"
      ],
      "x_nadsec_orgs": [
        "BTT TELECOMUNICACOES S.A."
      ]
    },
    {
      "created": "2026-04-16T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--81992fa7-991b-455f-b168-683d8b2b96b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T18:05:10.000Z",
      "valid_until": "2026-05-18T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T17:22:35.846Z",
      "x_nadsec_last_seen": "2026-04-16T17:22:35.846Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-16T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=epmapper; ports=135; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--24bc8686-78e6-41b0-905e-754f130ccaf3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.250.47.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T18:05:10.000Z",
      "valid_until": "2026-05-18T18:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-16T17:28:20.076Z",
      "x_nadsec_last_seen": "2026-04-16T17:29:02.804Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-16T20:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--80245ad1-b035-4256-adb5-7662512a34df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T20:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.194.251.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T20:05:16.000Z",
      "valid_until": "2026-05-18T20:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-16T19:41:02.453Z",
      "x_nadsec_last_seen": "2026-04-16T19:41:21.283Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-16T20:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MY; asn=9534; asn_org=Binariang Berhad",
      "id": "indicator--4f97f50e-4c6f-432b-a0f7-9090aff1d10a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T20:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '121.122.138.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T20:05:16.000Z",
      "valid_until": "2026-05-18T20:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T19:42:32.880Z",
      "x_nadsec_last_seen": "2026-04-16T19:42:32.880Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "9534"
      ],
      "x_nadsec_orgs": [
        "Binariang Berhad"
      ]
    },
    {
      "created": "2026-04-16T20:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=9260; asn_org=Multinet Pakistan Pvt. Ltd.",
      "id": "indicator--8760a107-7544-4bdb-a520-91125ea41e1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T20:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '125.209.98.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T20:05:16.000Z",
      "valid_until": "2026-05-18T20:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-16T19:45:26.887Z",
      "x_nadsec_last_seen": "2026-04-16T19:45:27.006Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9260"
      ],
      "x_nadsec_orgs": [
        "Multinet Pakistan Pvt. Ltd."
      ]
    },
    {
      "created": "2026-04-16T20:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--dd19fa6c-bc44-48ec-9ac2-b162ab16d8a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T20:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '13.86.105.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T20:05:16.000Z",
      "valid_until": "2026-05-18T20:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-16T19:26:45.981Z",
      "x_nadsec_last_seen": "2026-04-16T19:26:56.156Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-16T20:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--e906fba4-af67-4397-aa49-0dd5c7e9fd0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T20:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.224.170.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T20:05:16.000Z",
      "valid_until": "2026-05-18T20:05:03.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-04-16T19:25:22.992Z",
      "x_nadsec_last_seen": "2026-04-19T12:13:55.903Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-16T20:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--3031174d-685c-47cd-8a0f-10fb80c13297",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T20:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T20:05:16.000Z",
      "valid_until": "2026-05-18T20:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-16T19:24:43.148Z",
      "x_nadsec_last_seen": "2026-04-16T19:24:43.941Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-16T20:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=httpd; ports=81; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--36d9191e-13af-40e0-9a9c-694b8d7f3d6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T20:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.245.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T20:05:16.000Z",
      "valid_until": "2026-05-18T20:05:03.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-16T19:15:02.927Z",
      "x_nadsec_last_seen": "2026-04-16T19:15:54.390Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-16T20:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--98202337-4317-4256-8f53-da27178d7395",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T20:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.41.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T20:05:16.000Z",
      "valid_until": "2026-05-18T20:05:03.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-16T19:58:02.927Z",
      "x_nadsec_last_seen": "2026-04-16T19:58:48.068Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-16T20:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=httpd; ports=81; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--4922af1e-b81b-4f6c-85cd-5e188b20cf88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T20:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '167.71.110.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T20:05:16.000Z",
      "valid_until": "2026-05-18T20:05:03.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-04-16T19:12:32.620Z",
      "x_nadsec_last_seen": "2026-04-16T19:14:22.686Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-16T20:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--5ba16619-00b5-4137-89fa-b06319339c20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T20:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.124.120.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T20:05:16.000Z",
      "valid_until": "2026-05-18T20:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T19:47:25.784Z",
      "x_nadsec_last_seen": "2026-04-16T19:47:25.784Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-16T20:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AU; asn=1221; asn_org=Telstra Limited",
      "id": "indicator--539900c4-388d-4e90-93d9-c56e65f94fed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T20:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '58.163.142.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T20:05:16.000Z",
      "valid_until": "2026-05-18T20:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-16T19:05:05.411Z",
      "x_nadsec_last_seen": "2026-04-16T19:07:08.589Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "1221"
      ],
      "x_nadsec_orgs": [
        "Telstra Limited"
      ]
    },
    {
      "created": "2026-04-16T20:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=21479; asn_org=Rostelecom",
      "id": "indicator--ebd643ab-9094-4065-a17e-9d2473b1fbf4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T20:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.117.2.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T20:05:16.000Z",
      "valid_until": "2026-05-18T20:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-16T20:03:40.296Z",
      "x_nadsec_last_seen": "2026-04-16T20:05:48.118Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "21479"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-16T21:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--24d28e71-9c43-46e6-9051-227d646521e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T21:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '52.224.241.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T21:05:11.000Z",
      "valid_until": "2026-05-18T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T20:32:50.031Z",
      "x_nadsec_last_seen": "2026-04-16T20:32:50.031Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-16T21:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IQ; asn=48407; asn_org=TigrisNet",
      "id": "indicator--01961c45-c9ec-408f-a827-cd12be5be9dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T21:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '93.94.53.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T21:05:11.000Z",
      "valid_until": "2026-05-18T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-16T20:53:46.443Z",
      "x_nadsec_last_seen": "2026-04-16T20:53:46.549Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IQ"
      ],
      "x_nadsec_asns": [
        "48407"
      ],
      "x_nadsec_orgs": [
        "TigrisNet"
      ]
    },
    {
      "created": "2026-04-16T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--e29ac8e7-16b0-4ce6-a220-f8e08b607afe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.208.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T22:05:05.000Z",
      "valid_until": "2026-05-18T22:05:03.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-16T21:45:33.971Z",
      "x_nadsec_last_seen": "2026-04-16T21:46:19.748Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-16T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=4796; asn_org=Institute of Technology Bandung",
      "id": "indicator--f5a0aaf3-8dc7-4464-be88-fb2ac34c4261",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '167.205.0.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T22:05:05.000Z",
      "valid_until": "2026-05-18T22:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-16T21:23:50.177Z",
      "x_nadsec_last_seen": "2026-04-17T04:47:05.840Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "4796"
      ],
      "x_nadsec_orgs": [
        "Institute of Technology Bandung"
      ]
    },
    {
      "created": "2026-04-16T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=24835; asn_org=RAYA Telecom - Egypt",
      "id": "indicator--fa7bf9a0-136e-4a4a-b671-894b05844784",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.221.208.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T22:05:05.000Z",
      "valid_until": "2026-05-18T22:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-16T21:17:35.117Z",
      "x_nadsec_last_seen": "2026-04-16T21:19:41.777Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24835"
      ],
      "x_nadsec_orgs": [
        "RAYA Telecom - Egypt"
      ]
    },
    {
      "created": "2026-04-16T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--8b844399-f00c-4ebe-9907-be39a9303ba7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T22:05:05.000Z",
      "valid_until": "2026-05-18T22:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T21:12:42.170Z",
      "x_nadsec_last_seen": "2026-04-16T21:12:42.170Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-16T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--a53d33d3-ee15-4a6b-a2f2-54f115e6e4c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.245.141.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T22:05:05.000Z",
      "valid_until": "2026-05-18T22:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-16T21:17:07.307Z",
      "x_nadsec_last_seen": "2026-04-16T21:17:31.597Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-16T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--b8182c66-c5ea-4ddb-b122-fd002d043364",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.251.182.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T22:05:05.000Z",
      "valid_until": "2026-05-18T22:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T21:39:09.667Z",
      "x_nadsec_last_seen": "2026-04-16T21:39:09.667Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-16T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--6d22ab3d-9c64-4ee4-a0bc-34a9fe0ccdac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T22:05:05.000Z",
      "valid_until": "2026-05-18T22:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T21:33:44.063Z",
      "x_nadsec_last_seen": "2026-04-16T21:33:44.063Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-16T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--9c44980d-c47c-4ecb-b9b4-65a4a178ac7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.165.236.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T23:05:03.000Z",
      "valid_until": "2026-05-18T23:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-16T22:08:34.130Z",
      "x_nadsec_last_seen": "2026-04-16T22:10:38.447Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-04-16T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--c6f33ef5-4977-4740-be9a-3eaa05754aab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T23:05:03.000Z",
      "valid_until": "2026-05-18T23:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-11T23:08:50.872Z",
      "x_nadsec_last_seen": "2026-04-16T22:30:52.895Z",
      "x_nadsec_ports": [
        "135",
        "1723"
      ],
      "x_nadsec_services": [
        "epmapper",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-16T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--7677b7b1-4a75-4447-a10f-d845ffb39820",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.42.237.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T23:05:03.000Z",
      "valid_until": "2026-05-18T23:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-16T22:07:00.594Z",
      "x_nadsec_last_seen": "2026-04-16T22:07:00.594Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-16T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--96eb34c6-ae75-4e33-9ed0-0e5201e7abfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T23:05:03.000Z",
      "valid_until": "2026-05-18T23:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-16T22:08:30.183Z",
      "x_nadsec_last_seen": "2026-04-16T22:08:30.826Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-16T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=21; services=mongod; ports=27017; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--21610cdd-2b73-4c4d-baa0-96c23e092993",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.153.34.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T23:05:03.000Z",
      "valid_until": "2026-05-18T23:05:00.000Z",
      "x_nadsec_event_count": 42,
      "x_nadsec_first_seen": "2026-04-16T22:55:55.125Z",
      "x_nadsec_last_seen": "2026-04-23T20:40:45.228Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-04-16T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=GB; asn=13285; asn_org=TalkTalk; user(top)=**",
      "id": "indicator--9e52a1a0-7a27-4a2f-930c-29eb52287ab0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '80.47.12.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T23:05:03.000Z",
      "valid_until": "2026-05-18T23:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-16T23:03:17.373Z",
      "x_nadsec_last_seen": "2026-04-26T12:14:28.312Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "13285"
      ],
      "x_nadsec_orgs": [
        "TalkTalk"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-17T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--861b8ef4-c890-4df0-a746-54a8c631ebfe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.225.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T00:05:10.000Z",
      "valid_until": "2026-05-19T00:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-17T00:00:25.682Z",
      "x_nadsec_last_seen": "2026-04-17T00:01:10.853Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-17T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--e48b1240-f50b-4dd1-be4d-7477cabe26f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.241.15.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T00:05:10.000Z",
      "valid_until": "2026-05-19T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-16T23:58:03.142Z",
      "x_nadsec_last_seen": "2026-04-17T00:00:09.500Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-04-17T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ZA; asn=36937; asn_org=Neotel",
      "id": "indicator--a7ae4174-9a35-4225-afe4-342e74751a0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.162.56.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T00:05:10.000Z",
      "valid_until": "2026-05-19T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-16T23:24:24.369Z",
      "x_nadsec_last_seen": "2026-04-26T20:51:16.853Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "36937"
      ],
      "x_nadsec_orgs": [
        "Neotel"
      ]
    },
    {
      "created": "2026-04-17T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=262907; asn_org=BRASIL TECPAR | AMIGO | AVATO",
      "id": "indicator--900efc71-68fc-4f33-b6fa-5e5579c938ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.226.17.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T00:05:10.000Z",
      "valid_until": "2026-05-19T00:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-16T23:25:12.134Z",
      "x_nadsec_last_seen": "2026-04-16T23:32:17.440Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262907"
      ],
      "x_nadsec_orgs": [
        "BRASIL TECPAR | AMIGO | AVATO"
      ]
    },
    {
      "created": "2026-04-17T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--08934c6b-322b-46c1-bffb-14f7f949d41e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T00:05:10.000Z",
      "valid_until": "2026-05-19T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-16T23:40:49.386Z",
      "x_nadsec_last_seen": "2026-04-18T23:32:03.667Z",
      "x_nadsec_ports": [
        "1433",
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-17T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**; pass(top)=1**1",
      "id": "indicator--c4e7f782-af16-494c-a392-f113370297bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '120.36.140.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T01:05:11.000Z",
      "valid_until": "2026-05-19T01:05:09.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-04-17T00:39:16.640Z",
      "x_nadsec_last_seen": "2026-04-17T00:39:26.578Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1**1"
      ]
    },
    {
      "created": "2026-04-17T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--b6818711-d4e8-4395-81c7-5b1fbf9c1403",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '161.49.93.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T01:05:11.000Z",
      "valid_until": "2026-05-19T01:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-17T00:28:50.686Z",
      "x_nadsec_last_seen": "2026-04-17T00:36:01.442Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-04-17T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--2c6c8066-5639-4561-b0f5-3dc09bea9855",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '54.236.228.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T01:05:11.000Z",
      "valid_until": "2026-05-19T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-17T00:56:57.488Z",
      "x_nadsec_last_seen": "2026-04-17T00:56:57.488Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-17T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--6d7e56c3-70ec-40f0-8b39-9e7428175984",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.135.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T03:05:13.000Z",
      "valid_until": "2026-05-19T03:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-17T02:28:43.371Z",
      "x_nadsec_last_seen": "2026-04-30T13:46:38.315Z",
      "x_nadsec_ports": [
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-17T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=262907; asn_org=BRASIL TECPAR | AMIGO | AVATO",
      "id": "indicator--315833d5-a406-42af-8658-37a838c393b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '177.36.35.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T03:05:13.000Z",
      "valid_until": "2026-05-19T03:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-17T02:05:09.644Z",
      "x_nadsec_last_seen": "2026-04-17T02:12:12.421Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262907"
      ],
      "x_nadsec_orgs": [
        "BRASIL TECPAR | AMIGO | AVATO"
      ]
    },
    {
      "created": "2026-04-17T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a1155fbc-6960-490c-9622-8310691223a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T03:05:13.000Z",
      "valid_until": "2026-05-19T03:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-17T02:08:09.234Z",
      "x_nadsec_last_seen": "2026-04-17T02:08:09.234Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-17T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--5b5c7b65-2ef0-4fd4-8cee-249ed54ba896",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T03:05:13.000Z",
      "valid_until": "2026-05-19T03:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-17T02:39:16.492Z",
      "x_nadsec_last_seen": "2026-04-17T02:39:16.492Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-17T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia; user(top)=**; pass(top)=1*******9",
      "id": "indicator--99f48fc4-fdb9-47ff-bff6-12db71f757ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.73.33.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T03:05:13.000Z",
      "valid_until": "2026-05-19T03:05:12.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-04-17T02:51:01.012Z",
      "x_nadsec_last_seen": "2026-04-17T02:51:14.845Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1*******9"
      ]
    },
    {
      "created": "2026-04-17T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=NL; asn=205759; asn_org=Ghosty Networks LLC; user(top)=r**t",
      "id": "indicator--87fe8501-c4ae-4d8f-9734-f7fbf5d6d2fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.151.182.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T03:05:13.000Z",
      "valid_until": "2026-05-19T03:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-17T02:07:28.955Z",
      "x_nadsec_last_seen": "2026-04-17T02:07:28.955Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "205759"
      ],
      "x_nadsec_orgs": [
        "Ghosty Networks LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-17T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--6a78b2b8-efef-4baa-a845-cb5983d8b44e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T03:05:13.000Z",
      "valid_until": "2026-05-19T03:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-17T02:26:43.336Z",
      "x_nadsec_last_seen": "2026-04-29T14:53:25.447Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-17T05:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--efa66c1a-ce81-4e68-a640-e7e1d931adca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T05:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '117.241.147.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T05:05:06.000Z",
      "valid_until": "2026-05-19T05:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-17T04:31:53.115Z",
      "x_nadsec_last_seen": "2026-04-17T04:33:58.081Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-04-17T05:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--6371437a-b1fa-4b66-b2ff-eb158b46c715",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T05:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.129.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T05:05:06.000Z",
      "valid_until": "2026-05-19T05:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-17T05:02:26.967Z",
      "x_nadsec_last_seen": "2026-04-22T19:37:59.621Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-17T05:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--278100d7-42f3-4bf8-b47e-fd9341f39119",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T05:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T05:05:06.000Z",
      "valid_until": "2026-05-19T05:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-17T04:31:52.848Z",
      "x_nadsec_last_seen": "2026-04-17T04:31:52.848Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-17T06:05:27.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--563081ad-ca09-4901-a822-294afba1149c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T06:05:27.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.194.251.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T06:05:27.000Z",
      "valid_until": "2026-05-19T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-17T05:29:18.197Z",
      "x_nadsec_last_seen": "2026-04-17T05:29:18.197Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-17T06:05:27.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--a0e92841-11c3-4ce6-ac97-d600b6224a7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T06:05:27.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.73.111.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T06:05:27.000Z",
      "valid_until": "2026-05-19T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-17T05:07:07.974Z",
      "x_nadsec_last_seen": "2026-04-17T05:09:13.040Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-04-17T06:05:27.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=269597; asn_org=STALKER ENGENHARIA EIRELI",
      "id": "indicator--1fa58f1c-0b14-4485-a9c5-a1fafcdb1ce9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T06:05:27.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.71.209.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T06:05:27.000Z",
      "valid_until": "2026-05-19T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-17T05:30:34.769Z",
      "x_nadsec_last_seen": "2026-04-17T05:32:41.334Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "269597"
      ],
      "x_nadsec_orgs": [
        "STALKER ENGENHARIA EIRELI"
      ]
    },
    {
      "created": "2026-04-17T06:05:27.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=3326; asn_org=Private Joint Stock Company datagroup",
      "id": "indicator--e715863f-9733-495e-9b4e-cd91563c47e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T06:05:27.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.164.171.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T06:05:27.000Z",
      "valid_until": "2026-05-19T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-17T05:09:01.203Z",
      "x_nadsec_last_seen": "2026-04-17T05:11:08.676Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "3326"
      ],
      "x_nadsec_orgs": [
        "Private Joint Stock Company datagroup"
      ]
    },
    {
      "created": "2026-04-17T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VE; asn=8053; asn_org=IFX Networks Venezuela C.A.",
      "id": "indicator--a7134134-8d80-4903-aee3-0ccece08ade5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '181.225.58.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T08:05:11.000Z",
      "valid_until": "2026-05-19T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-17T07:22:40.820Z",
      "x_nadsec_last_seen": "2026-04-17T07:22:40.820Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8053"
      ],
      "x_nadsec_orgs": [
        "IFX Networks Venezuela C.A."
      ]
    },
    {
      "created": "2026-04-17T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--9c9a0ade-e06a-465b-8ba2-1fe732aa2b8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T08:05:11.000Z",
      "valid_until": "2026-05-19T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-17T08:04:38.283Z",
      "x_nadsec_last_seen": "2026-04-17T08:05:47.812Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-04-17T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--5416bf83-23b8-4ad0-aa8d-6f1fd4a465e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.54.1.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T08:05:11.000Z",
      "valid_until": "2026-05-19T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-17T07:45:25.903Z",
      "x_nadsec_last_seen": "2026-04-17T07:47:32.403Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-17T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--bcd374af-f6b4-45fe-a70c-d83200b497d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.192.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T08:05:11.000Z",
      "valid_until": "2026-05-19T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-17T07:07:02.693Z",
      "x_nadsec_last_seen": "2026-04-17T07:07:03.032Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-17T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mysqld; ports=3306; cc=DE; asn=212512; asn_org=Detai Prosperous Technologies Limited",
      "id": "indicator--8dfee77e-4063-4ab7-9a72-097c4a1fdb8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T08:05:11.000Z",
      "valid_until": "2026-05-19T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-17T07:34:19.150Z",
      "x_nadsec_last_seen": "2026-04-22T18:51:04.554Z",
      "x_nadsec_ports": [
        "3306",
        "21"
      ],
      "x_nadsec_services": [
        "mysqld",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "212512"
      ],
      "x_nadsec_orgs": [
        "Detai Prosperous Technologies Limited"
      ]
    },
    {
      "created": "2026-04-17T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--98c85f96-9b85-4949-9512-9681dd2b382a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T08:05:11.000Z",
      "valid_until": "2026-05-19T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-17T07:31:35.588Z",
      "x_nadsec_last_seen": "2026-04-20T07:32:02.811Z",
      "x_nadsec_ports": [
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-17T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=DE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--838ab9d6-891a-4006-98e3-128cd8eededb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.193.59.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T09:05:11.000Z",
      "valid_until": "2026-05-19T09:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-17T08:40:39.642Z",
      "x_nadsec_last_seen": "2026-04-17T08:41:25.560Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-17T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--bc03444f-4826-4130-b08f-5d15eb547874",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.168.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T09:05:11.000Z",
      "valid_until": "2026-05-19T09:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-17T08:22:46.051Z",
      "x_nadsec_last_seen": "2026-04-17T08:23:32.681Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-17T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--d116ca4d-63fd-42b1-a215-79535e4c232e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T09:05:11.000Z",
      "valid_until": "2026-05-19T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-17T08:11:10.274Z",
      "x_nadsec_last_seen": "2026-04-17T08:11:10.274Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-04-17T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--ad96b81a-c723-48fb-aa88-0690f27d5ff5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.79.152.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T09:05:11.000Z",
      "valid_until": "2026-05-19T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-17T08:15:09.532Z",
      "x_nadsec_last_seen": "2026-04-17T08:15:09.532Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-17T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--ba6b3a06-f193-4d36-8c9a-6c9616225651",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T09:05:11.000Z",
      "valid_until": "2026-05-19T09:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-17T08:45:01.337Z",
      "x_nadsec_last_seen": "2026-04-20T09:32:57.807Z",
      "x_nadsec_ports": [
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-17T10:05:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--8614d17a-468a-48b6-8b50-d3e992e33447",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T10:05:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.155.46.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T10:05:31.000Z",
      "valid_until": "2026-05-19T10:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-17T09:22:43.944Z",
      "x_nadsec_last_seen": "2026-04-17T09:22:43.944Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-17T10:05:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services; user(top)=**",
      "id": "indicator--00b1630f-bd70-4279-9897-4b58c9b503c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T10:05:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '122.163.178.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T10:05:31.000Z",
      "valid_until": "2026-05-19T10:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-17T09:24:55.646Z",
      "x_nadsec_last_seen": "2026-04-17T09:24:55.646Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-17T10:05:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17754; asn_org=Excellmedia",
      "id": "indicator--87255ead-4d76-4a41-8079-9491b8273b5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T10:05:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '175.101.31.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T10:05:31.000Z",
      "valid_until": "2026-05-19T10:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-17T09:05:56.958Z",
      "x_nadsec_last_seen": "2026-04-17T09:08:02.443Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17754"
      ],
      "x_nadsec_orgs": [
        "Excellmedia"
      ]
    },
    {
      "created": "2026-04-17T10:05:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=SY; asn=29256; asn_org=Syrian Telecommunication Private Closed Joint Stock Company; user(top)=**",
      "id": "indicator--ee2d6adf-46c6-404b-b6bc-efa431ea15fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T10:05:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '82.137.223.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T10:05:31.000Z",
      "valid_until": "2026-05-19T10:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-17T09:19:44.457Z",
      "x_nadsec_last_seen": "2026-04-17T09:19:44.457Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SY"
      ],
      "x_nadsec_asns": [
        "29256"
      ],
      "x_nadsec_orgs": [
        "Syrian Telecommunication Private Closed Joint Stock Company"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-17T10:05:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--fcb667a6-c5c5-4d42-b922-be26abaa4df6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T10:05:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T10:05:31.000Z",
      "valid_until": "2026-05-19T10:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-17T09:55:08.530Z",
      "x_nadsec_last_seen": "2026-04-17T09:55:08.530Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-17T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=RU; asn=29226; asn_org=JSC Mastertel",
      "id": "indicator--09cc842a-b33e-45ea-8d26-d823d2d208ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.238.113.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T11:05:13.000Z",
      "valid_until": "2026-05-19T11:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-17T10:16:49.484Z",
      "x_nadsec_last_seen": "2026-04-17T10:16:49.484Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "29226"
      ],
      "x_nadsec_orgs": [
        "JSC Mastertel"
      ]
    },
    {
      "created": "2026-04-17T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TR; asn=8517; asn_org=National Academic Network and Information Center",
      "id": "indicator--7f209375-f723-4c70-93ad-ee8fdc3ea965",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '193.140.242.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T11:05:13.000Z",
      "valid_until": "2026-05-19T11:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-17T11:00:00.900Z",
      "x_nadsec_last_seen": "2026-04-27T03:07:23.648Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "8517"
      ],
      "x_nadsec_orgs": [
        "National Academic Network and Information Center"
      ]
    },
    {
      "created": "2026-04-17T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=SC; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--e2add2ba-aee4-4ed7-996e-a0775a560d30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.194.70.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T11:05:13.000Z",
      "valid_until": "2026-05-19T11:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-17T10:45:27.116Z",
      "x_nadsec_last_seen": "2026-04-17T10:46:11.143Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-17T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=FR; asn=16276; asn_org=OVH SAS",
      "id": "indicator--9a739eb7-f862-4cad-9abd-ca06832485d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.105.132.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T11:05:13.000Z",
      "valid_until": "2026-05-19T11:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-17T10:28:17.044Z",
      "x_nadsec_last_seen": "2026-04-17T10:33:43.946Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ]
    },
    {
      "created": "2026-04-17T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--122e0e20-454e-4ec4-89eb-ffa98fb168df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.251.101.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T11:05:13.000Z",
      "valid_until": "2026-05-19T11:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-17T10:32:13.988Z",
      "x_nadsec_last_seen": "2026-04-17T10:32:37.690Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-17T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=KZ; asn=200590; asn_org=NLS Kazakhstan LLC",
      "id": "indicator--d2f52842-5c21-43c2-a0c9-375760a275b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '77.240.44.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T11:05:13.000Z",
      "valid_until": "2026-05-19T11:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-17T10:40:27.136Z",
      "x_nadsec_last_seen": "2026-04-25T11:59:38.279Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "200590"
      ],
      "x_nadsec_orgs": [
        "NLS Kazakhstan LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-17T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--6ababf7d-db2c-4b18-9f01-4247f404e35d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T11:05:13.000Z",
      "valid_until": "2026-05-19T11:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-17T10:29:52.622Z",
      "x_nadsec_last_seen": "2026-04-17T10:29:52.622Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-04-17T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mongod; ports=27017; cc=BR; asn=264377; asn_org=FV TECNOLOGIA DA INFORMACAO LTDA ME",
      "id": "indicator--ac2236fd-2eac-493e-b6ea-8fb64821c633",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '131.161.123.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T12:05:11.000Z",
      "valid_until": "2026-05-19T12:05:09.000Z",
      "x_nadsec_event_count": 39,
      "x_nadsec_first_seen": "2026-04-17T06:09:28.576Z",
      "x_nadsec_last_seen": "2026-04-26T08:06:05.269Z",
      "x_nadsec_ports": [
        "21",
        "1723",
        "27017",
        "81",
        "445",
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod",
        "pptpd",
        "httpd",
        "mssqld",
        "smbd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "264377"
      ],
      "x_nadsec_orgs": [
        "FV TECNOLOGIA DA INFORMACAO LTDA ME"
      ]
    },
    {
      "created": "2026-04-17T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=27699; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--b364ebeb-dc38-4c3c-8423-d3908ef6112e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.249.27.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T12:05:11.000Z",
      "valid_until": "2026-05-19T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-17T12:01:44.775Z",
      "x_nadsec_last_seen": "2026-04-17T12:03:52.142Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "27699"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-04-17T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=epmapper; ports=135; cc=AE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--68ef53ee-dfe4-4442-8bde-1b81e1f101de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.181.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T12:05:11.000Z",
      "valid_until": "2026-05-19T12:05:09.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-04-17T11:54:40.391Z",
      "x_nadsec_last_seen": "2026-04-17T12:13:46.427Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-17T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--be976e5c-7f61-4ed2-a6c0-110130d4cb95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.77.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T12:05:11.000Z",
      "valid_until": "2026-05-19T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-17T11:27:10.827Z",
      "x_nadsec_last_seen": "2026-04-17T11:29:15.225Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-04-17T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=214996; asn_org=netcup GmbH",
      "id": "indicator--3891d9a3-0514-40f9-a1bd-3d192f9fc82c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.53.81.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T12:05:11.000Z",
      "valid_until": "2026-05-19T12:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-17T12:02:25.089Z",
      "x_nadsec_last_seen": "2026-04-17T17:02:24.337Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "214996"
      ],
      "x_nadsec_orgs": [
        "netcup GmbH"
      ]
    },
    {
      "created": "2026-04-17T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--1305746f-6681-4f93-be00-9ea184470da5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.193.57.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T14:05:11.000Z",
      "valid_until": "2026-05-19T14:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-17T13:25:28.124Z",
      "x_nadsec_last_seen": "2026-04-17T13:26:12.385Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-17T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=KR; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--d77e18de-de89-476e-b91b-c80f331c3f39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.194.248.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T14:05:11.000Z",
      "valid_until": "2026-05-19T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-17T13:36:29.074Z",
      "x_nadsec_last_seen": "2026-04-17T13:36:48.696Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-17T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--2d571f8e-14d9-435f-a6d0-21be1b4c4777",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T14:05:11.000Z",
      "valid_until": "2026-05-19T14:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-17T13:25:27.554Z",
      "x_nadsec_last_seen": "2026-04-28T09:58:04.532Z",
      "x_nadsec_ports": [
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-17T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--ea62c971-51a3-4045-8f4d-e39a8aaf5b12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T14:05:11.000Z",
      "valid_until": "2026-05-19T14:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-09T11:57:03.151Z",
      "x_nadsec_last_seen": "2026-04-30T14:50:56.965Z",
      "x_nadsec_ports": [
        "3306",
        "21",
        "81",
        "1883"
      ],
      "x_nadsec_services": [
        "mysqld",
        "ftpd",
        "httpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-17T15:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--13b1f9cf-73a7-4b9e-9c7e-0b914a404565",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T15:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '89.109.35.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T15:05:15.000Z",
      "valid_until": "2026-05-19T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-17T14:49:24.669Z",
      "x_nadsec_last_seen": "2026-04-17T14:51:31.390Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-17T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--294346e2-c933-4195-9ed1-86a407fd1097",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '106.222.214.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T16:05:02.000Z",
      "valid_until": "2026-05-19T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-17T15:53:07.049Z",
      "x_nadsec_last_seen": "2026-04-17T15:55:12.345Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-04-17T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=32475; asn_org=Internap Holding LLC",
      "id": "indicator--d44611ed-e469-4c1a-8178-f6ffe830b310",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '108.178.22.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T16:05:02.000Z",
      "valid_until": "2026-05-19T16:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-17T15:36:14.323Z",
      "x_nadsec_last_seen": "2026-04-17T15:36:14.515Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "32475"
      ],
      "x_nadsec_orgs": [
        "Internap Holding LLC"
      ]
    },
    {
      "created": "2026-04-17T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--531603ba-b99f-488f-b833-0d6a16bc6d49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '116.235.120.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T16:05:02.000Z",
      "valid_until": "2026-05-19T16:05:01.000Z",
      "x_nadsec_event_count": 25,
      "x_nadsec_first_seen": "2026-04-17T16:04:09.781Z",
      "x_nadsec_last_seen": "2026-04-17T16:06:43.966Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-04-17T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--7330c72d-a585-4b4d-848a-f43b86826036",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T16:05:02.000Z",
      "valid_until": "2026-05-19T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-17T15:20:32.885Z",
      "x_nadsec_last_seen": "2026-04-17T15:20:32.885Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-17T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--df92b265-4aa3-40ba-8564-523dab4871bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '218.64.4.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T16:05:02.000Z",
      "valid_until": "2026-05-19T16:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-17T15:33:43.781Z",
      "x_nadsec_last_seen": "2026-04-17T15:33:47.399Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-17T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BR; asn=269530; asn_org=ACCESSNET TELECOMUNICACOES EIRELI",
      "id": "indicator--af42ead1-f2c0-42f7-a019-a64fe05a4d08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.188.184.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T16:05:02.000Z",
      "valid_until": "2026-05-19T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-17T15:19:04.581Z",
      "x_nadsec_last_seen": "2026-04-17T15:19:04.581Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "269530"
      ],
      "x_nadsec_orgs": [
        "ACCESSNET TELECOMUNICACOES EIRELI"
      ]
    },
    {
      "created": "2026-04-17T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--b2886c1b-05b3-4600-b9ee-c5502e33cd19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '60.250.62.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T16:05:02.000Z",
      "valid_until": "2026-05-19T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-17T15:18:32.447Z",
      "x_nadsec_last_seen": "2026-04-17T15:20:38.607Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-17T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--5cdd0a97-7dc0-4555-9776-fbc07235f429",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.237.123.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T17:05:02.000Z",
      "valid_until": "2026-05-19T17:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-17T16:07:02.923Z",
      "x_nadsec_last_seen": "2026-04-17T16:07:03.713Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-17T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f91d21b7-69bd-4ad9-a260-dd2f0b76dfb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '192.241.144.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T17:05:02.000Z",
      "valid_until": "2026-05-19T17:05:00.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-17T16:59:39.164Z",
      "x_nadsec_last_seen": "2026-04-17T17:27:53.604Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "445",
        "1433",
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-17T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--94a4bcf5-bcfa-4650-b7b9-f7c237e21502",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.218.36.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T17:05:02.000Z",
      "valid_until": "2026-05-19T17:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-17T16:20:40.733Z",
      "x_nadsec_last_seen": "2026-04-17T16:20:41.706Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-17T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--d22f41b1-fe71-41c5-a8fb-a8e3a3df0eef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.218.36.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T17:05:02.000Z",
      "valid_until": "2026-05-19T17:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-17T16:20:41.056Z",
      "x_nadsec_last_seen": "2026-04-17T16:20:41.056Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-17T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--d0b612a9-a934-4a11-baa3-ba071b3c0510",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T17:05:02.000Z",
      "valid_until": "2026-05-19T17:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-17T16:18:09.808Z",
      "x_nadsec_last_seen": "2026-04-17T16:18:42.465Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-17T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a071f222-f622-4686-983a-3955b0de2df5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T17:05:02.000Z",
      "valid_until": "2026-05-19T17:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-17T16:29:54.696Z",
      "x_nadsec_last_seen": "2026-04-17T16:29:54.696Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-17T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--12369dce-846f-4287-ab34-02993b717d9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T17:05:02.000Z",
      "valid_until": "2026-05-19T17:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-17T16:41:44.260Z",
      "x_nadsec_last_seen": "2026-04-17T16:41:44.260Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-17T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--367fa495-92ed-4cbe-8c55-607e27a4fb93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.79.24.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T17:05:02.000Z",
      "valid_until": "2026-05-19T17:05:00.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-17T16:43:26.387Z",
      "x_nadsec_last_seen": "2026-04-25T10:59:59.531Z",
      "x_nadsec_ports": [
        "21",
        "3306",
        "81",
        "445"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld",
        "httpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-04-17T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=SA; asn=35819; asn_org=Etihad Etisalat, a joint stock company; user(top)=**",
      "id": "indicator--a6953111-d576-48dc-b6d2-79b6242b3c21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.152.144.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T17:05:02.000Z",
      "valid_until": "2026-05-19T17:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-17T17:02:56.334Z",
      "x_nadsec_last_seen": "2026-04-17T17:02:57.880Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "35819"
      ],
      "x_nadsec_orgs": [
        "Etihad Etisalat, a joint stock company"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-17T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PT; asn=15525; asn_org=Servicos De Comunicacoes E Multimedia S.A.",
      "id": "indicator--d3f5c91d-74a2-4ea9-b86b-2f470d8f9923",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '62.28.47.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T17:05:02.000Z",
      "valid_until": "2026-05-19T17:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-17T16:27:31.313Z",
      "x_nadsec_last_seen": "2026-04-17T16:27:31.877Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "15525"
      ],
      "x_nadsec_orgs": [
        "Servicos De Comunicacoes E Multimedia S.A."
      ]
    },
    {
      "created": "2026-04-17T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--5c430835-069b-4af6-8c54-cfcf28904510",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '110.139.238.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T19:05:11.000Z",
      "valid_until": "2026-05-19T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-17T18:17:58.662Z",
      "x_nadsec_last_seen": "2026-04-17T18:17:58.662Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-17T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--78f24f92-2a2e-49c1-b201-9c1254304cd5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.232.94.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T19:05:11.000Z",
      "valid_until": "2026-05-19T19:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-17T18:30:23.683Z",
      "x_nadsec_last_seen": "2026-04-17T18:33:43.383Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "445",
        "1883",
        "3306",
        "27017",
        "40073"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-17T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--a952befb-190b-47b0-bc62-24ef3da04d3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.232.32.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T19:05:11.000Z",
      "valid_until": "2026-05-19T19:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-17T17:56:12.243Z",
      "x_nadsec_last_seen": "2026-04-17T18:21:01.249Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-17T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--1b79ede9-1a87-4010-9baf-650cace14757",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.64.161.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T19:05:11.000Z",
      "valid_until": "2026-05-19T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-17T18:16:56.712Z",
      "x_nadsec_last_seen": "2026-04-17T18:18:10.488Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-17T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=HK; asn=135356; asn_org=GOIP Secunet Limited",
      "id": "indicator--af7a5357-ec4d-4f38-991c-fa121b725e2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.251.104.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T19:05:11.000Z",
      "valid_until": "2026-05-19T19:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-17T17:56:10.142Z",
      "x_nadsec_last_seen": "2026-04-17T18:18:38.692Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135356"
      ],
      "x_nadsec_orgs": [
        "GOIP Secunet Limited"
      ]
    },
    {
      "created": "2026-04-17T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=FR; asn=16276; asn_org=OVH SAS",
      "id": "indicator--04834c98-151f-4964-992c-f8a8eacef831",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.105.132.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T19:05:11.000Z",
      "valid_until": "2026-05-19T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-17T18:48:12.689Z",
      "x_nadsec_last_seen": "2026-04-17T18:48:13.362Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ]
    },
    {
      "created": "2026-04-17T20:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--fda1da40-ebe9-412e-bc30-c572c3c6ff6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T20:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '119.42.125.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T20:05:23.000Z",
      "valid_until": "2026-05-19T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-17T19:32:54.519Z",
      "x_nadsec_last_seen": "2026-04-17T19:34:59.532Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-04-17T20:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--56945d45-42e6-4288-92b5-710b2817ecb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T20:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T20:05:23.000Z",
      "valid_until": "2026-05-19T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-17T19:49:43.329Z",
      "x_nadsec_last_seen": "2026-04-17T19:49:43.329Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-17T20:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=11172; asn_org=Alestra, S. de R.L. de C.V.",
      "id": "indicator--630544ce-7b19-461e-af3b-33e145e4353f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T20:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '148.244.170.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T20:05:23.000Z",
      "valid_until": "2026-05-19T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-17T19:19:21.040Z",
      "x_nadsec_last_seen": "2026-04-17T19:19:21.173Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "11172"
      ],
      "x_nadsec_orgs": [
        "Alestra, S. de R.L. de C.V."
      ]
    },
    {
      "created": "2026-04-17T20:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--94fdc1fc-acbb-4302-9bde-d59303c1039a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T20:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T20:05:23.000Z",
      "valid_until": "2026-05-19T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-17T19:19:36.963Z",
      "x_nadsec_last_seen": "2026-04-17T19:19:36.963Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-17T20:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--75677e55-2a7d-4c11-a9c7-77b5a168a179",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T20:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.40.218.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T20:05:23.000Z",
      "valid_until": "2026-05-19T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-17T19:43:40.294Z",
      "x_nadsec_last_seen": "2026-04-29T15:14:38.137Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-17T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--fc4c0c24-dc83-49b9-a7bd-efcf1a74c446",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.96.143.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T21:05:02.000Z",
      "valid_until": "2026-05-19T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-17T20:51:06.640Z",
      "x_nadsec_last_seen": "2026-04-17T20:51:06.640Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-04-17T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--f8f3e1b7-88a1-4adf-a1af-224027e479b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T22:05:10.000Z",
      "valid_until": "2026-05-19T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-17T21:05:32.817Z",
      "x_nadsec_last_seen": "2026-04-28T19:23:14.521Z",
      "x_nadsec_ports": [
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-17T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--15bc4f70-7821-4729-853b-6c383945791d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.128.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T22:05:10.000Z",
      "valid_until": "2026-05-19T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-17T21:37:46.704Z",
      "x_nadsec_last_seen": "2026-04-17T21:37:46.704Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-17T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--7f20472e-38e7-41ac-8153-af9865525616",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T22:05:10.000Z",
      "valid_until": "2026-05-19T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-17T21:28:59.304Z",
      "x_nadsec_last_seen": "2026-04-17T21:28:59.304Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-17T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=36992; asn_org=Etisalat Misr",
      "id": "indicator--c0cd6cee-8f7a-4443-a8fd-84e325638d01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.64.172.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T22:05:10.000Z",
      "valid_until": "2026-05-19T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-17T21:49:32.251Z",
      "x_nadsec_last_seen": "2026-04-17T21:49:32.283Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "36992"
      ],
      "x_nadsec_orgs": [
        "Etisalat Misr"
      ]
    },
    {
      "created": "2026-04-17T23:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--0c571e02-68f9-4713-a4a6-3e737082155a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T23:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '107.150.105.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T23:05:11.000Z",
      "valid_until": "2026-05-19T23:05:08.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-17T23:04:24.658Z",
      "x_nadsec_last_seen": "2026-04-17T23:05:11.811Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-17T23:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--0ceccc98-5a2c-42e1-a463-4bbb782ea621",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T23:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '114.36.144.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T23:05:11.000Z",
      "valid_until": "2026-05-19T23:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-17T22:35:57.747Z",
      "x_nadsec_last_seen": "2026-04-17T22:35:57.894Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-17T23:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--47b41402-de3d-4945-ab96-0c2479621170",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T23:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.193.36.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T23:05:11.000Z",
      "valid_until": "2026-05-19T23:05:08.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-17T22:21:25.462Z",
      "x_nadsec_last_seen": "2026-04-17T22:22:11.257Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-17T23:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VE; asn=8053; asn_org=IFX Networks Venezuela C.A.",
      "id": "indicator--7ca1c572-748d-49bd-986f-be89393192ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T23:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '181.225.50.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T23:05:11.000Z",
      "valid_until": "2026-05-19T23:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-08T14:21:04.105Z",
      "x_nadsec_last_seen": "2026-04-17T22:59:23.115Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8053"
      ],
      "x_nadsec_orgs": [
        "IFX Networks Venezuela C.A."
      ]
    },
    {
      "created": "2026-04-17T23:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--1617166b-e86f-4197-9904-4d2a12450fc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T23:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.221.60.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T23:05:11.000Z",
      "valid_until": "2026-05-19T23:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-17T22:59:08.485Z",
      "x_nadsec_last_seen": "2026-04-17T22:59:08.485Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-17T23:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=httpd; ports=81; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--223d229f-b153-4023-8caa-4f4a59ed5ef6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T23:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T23:05:11.000Z",
      "valid_until": "2026-05-19T23:05:08.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-17T22:08:15.475Z",
      "x_nadsec_last_seen": "2026-04-17T22:08:55.748Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-04-17T23:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--468490fe-c298-46e1-88c3-4091b87793a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T23:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T23:05:11.000Z",
      "valid_until": "2026-05-19T23:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-17T22:32:23.048Z",
      "x_nadsec_last_seen": "2026-04-17T22:32:23.048Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-18T00:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=51612; asn_org=Alfatel plus Ltd",
      "id": "indicator--495c5b1e-d3e7-4ebf-86fc-2f3fe6df822d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T00:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.119.21.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T00:05:06.000Z",
      "valid_until": "2026-05-20T00:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-17T23:05:05.141Z",
      "x_nadsec_last_seen": "2026-04-17T23:07:12.228Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "51612"
      ],
      "x_nadsec_orgs": [
        "Alfatel plus Ltd"
      ]
    },
    {
      "created": "2026-04-18T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PH; asn=18187; asn_org=Ignite Telecommunications Inc",
      "id": "indicator--2934f570-a0e8-459d-869f-23d34bc81ad2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '122.49.208.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T02:05:11.000Z",
      "valid_until": "2026-05-20T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-18T01:36:36.813Z",
      "x_nadsec_last_seen": "2026-04-18T01:36:37.187Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "18187"
      ],
      "x_nadsec_orgs": [
        "Ignite Telecommunications Inc"
      ]
    },
    {
      "created": "2026-04-18T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e14d2941-9e09-455f-be46-e07dca5499fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.64.104.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T02:05:11.000Z",
      "valid_until": "2026-05-20T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-18T01:58:30.575Z",
      "x_nadsec_last_seen": "2026-04-18T01:58:40.735Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-18T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--dce9b5e4-e348-4cbf-b58f-ff91cd534f64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '125.165.253.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T04:05:11.000Z",
      "valid_until": "2026-05-20T04:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-18T03:53:02.017Z",
      "x_nadsec_last_seen": "2026-04-18T03:57:28.906Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-18T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a189593b-b8ae-463d-9910-b90bf207c19e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.119.96.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T04:05:11.000Z",
      "valid_until": "2026-05-20T04:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-18T03:13:29.591Z",
      "x_nadsec_last_seen": "2026-04-18T03:13:39.765Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-18T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--bc0c9f7c-2dc3-48e0-ba8e-f5a2d78cabf6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T04:05:11.000Z",
      "valid_until": "2026-05-20T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-18T03:57:52.953Z",
      "x_nadsec_last_seen": "2026-04-18T03:57:52.953Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-18T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--829c00a3-3525-429d-8dcb-891f17344f4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T04:05:11.000Z",
      "valid_until": "2026-05-20T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-18T03:37:15.332Z",
      "x_nadsec_last_seen": "2026-04-18T03:37:15.332Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-18T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AZ; asn=8814; asn_org=Aztelekom LLC",
      "id": "indicator--c56ac78e-42bf-4d1f-8285-d48613a661a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '80.69.55.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T04:05:11.000Z",
      "valid_until": "2026-05-20T04:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-18T03:13:07.139Z",
      "x_nadsec_last_seen": "2026-04-18T03:13:10.085Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "8814"
      ],
      "x_nadsec_orgs": [
        "Aztelekom LLC"
      ]
    },
    {
      "created": "2026-04-18T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=138088; asn_org=PT. Gratelindo Lintas Global",
      "id": "indicator--0066859e-1809-4201-91b6-44b2713bfc83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.124.160.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T05:05:10.000Z",
      "valid_until": "2026-05-20T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-18T04:52:42.897Z",
      "x_nadsec_last_seen": "2026-04-18T04:54:47.882Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "138088"
      ],
      "x_nadsec_orgs": [
        "PT. Gratelindo Lintas Global"
      ]
    },
    {
      "created": "2026-04-18T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=56041; asn_org=China Mobile communications corporation",
      "id": "indicator--8328a6b3-017c-42de-b818-3fe4e81e5a19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '112.16.199.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T05:05:10.000Z",
      "valid_until": "2026-05-20T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-18T04:53:57.780Z",
      "x_nadsec_last_seen": "2026-04-18T04:53:58.088Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56041"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-04-18T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--f9b8e5e1-7f5a-4ca5-a178-d1b339c4f038",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '183.82.101.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T05:05:10.000Z",
      "valid_until": "2026-05-20T05:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-18T04:46:43.329Z",
      "x_nadsec_last_seen": "2026-04-18T04:53:22.235Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-04-18T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--d962f10c-29b2-4942-a11d-9ad3afc585e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T05:05:10.000Z",
      "valid_until": "2026-05-20T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-18T04:53:15.275Z",
      "x_nadsec_last_seen": "2026-04-29T03:27:26.443Z",
      "x_nadsec_ports": [
        "21",
        "1883"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-18T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--20bc6991-022a-499f-a895-fa8efa90803c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T05:05:10.000Z",
      "valid_until": "2026-05-20T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-18T04:40:44.690Z",
      "x_nadsec_last_seen": "2026-04-18T04:40:44.690Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-18T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SC; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--61854f01-6bfb-4d3b-a971-b2b6d4bb82b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.194.70.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T05:05:10.000Z",
      "valid_until": "2026-05-20T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-18T04:42:54.813Z",
      "x_nadsec_last_seen": "2026-04-18T04:42:54.813Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-18T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a9320f2f-cf63-4eac-ba66-6f4528c275b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '13.86.117.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T06:05:03.000Z",
      "valid_until": "2026-05-20T06:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-18T05:35:48.772Z",
      "x_nadsec_last_seen": "2026-04-18T05:35:49.122Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-18T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--170790b2-a92f-4f8e-afbb-42a84bf8ac95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '130.131.162.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T06:05:03.000Z",
      "valid_until": "2026-05-20T06:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-18T05:52:55.422Z",
      "x_nadsec_last_seen": "2026-04-18T05:52:56.130Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-18T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=12735; asn_org=TurkNet Iletisim Hizmetleri A.S.",
      "id": "indicator--62269cbd-b60d-494d-9e82-2d9bb8743a8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '159.146.23.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T06:05:03.000Z",
      "valid_until": "2026-05-20T06:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-18T05:49:43.195Z",
      "x_nadsec_last_seen": "2026-04-18T05:56:44.409Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "12735"
      ],
      "x_nadsec_orgs": [
        "TurkNet Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-04-18T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--3c090931-39ff-4ef0-b774-bedf43a8b305",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.172.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T06:05:03.000Z",
      "valid_until": "2026-05-20T06:05:00.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-18T05:57:08.218Z",
      "x_nadsec_last_seen": "2026-04-18T05:57:53.399Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-18T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=XK; asn=8661; asn_org=Telekomi i Kosoves SH.A.",
      "id": "indicator--ca38ee80-e49e-404d-aa40-dfb93b0d6f06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '213.163.104.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T06:05:03.000Z",
      "valid_until": "2026-05-20T06:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-18T06:03:19.475Z",
      "x_nadsec_last_seen": "2026-04-18T06:10:30.494Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "XK"
      ],
      "x_nadsec_asns": [
        "8661"
      ],
      "x_nadsec_orgs": [
        "Telekomi i Kosoves SH.A."
      ]
    },
    {
      "created": "2026-04-18T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--b45533cc-4a62-4042-b6d2-e4b794eef3e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T06:05:03.000Z",
      "valid_until": "2026-05-20T06:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-18T05:32:01.892Z",
      "x_nadsec_last_seen": "2026-04-18T05:32:01.892Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-18T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=133676; asn_org=Precious netcom pvt ltd",
      "id": "indicator--d492265f-4c50-41c1-88db-72f561c80742",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.195.27.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T07:05:10.000Z",
      "valid_until": "2026-05-20T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-18T06:08:06.782Z",
      "x_nadsec_last_seen": "2026-04-18T06:14:36.725Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133676"
      ],
      "x_nadsec_orgs": [
        "Precious netcom pvt ltd"
      ]
    },
    {
      "created": "2026-04-18T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--b904e24c-c26e-4d46-ab0c-afa0de34bbd1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.162.1.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T07:05:10.000Z",
      "valid_until": "2026-05-20T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-18T06:48:36.878Z",
      "x_nadsec_last_seen": "2026-04-18T06:48:36.878Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-18T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=31; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--fed6e4f4-8862-49b8-a249-8e28e58bd308",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '167.99.9.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T07:05:10.000Z",
      "valid_until": "2026-05-20T07:05:09.000Z",
      "x_nadsec_event_count": 31,
      "x_nadsec_first_seen": "2026-04-18T06:18:36.711Z",
      "x_nadsec_last_seen": "2026-04-18T06:21:26.288Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-18T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--61b4f97f-0dd4-4358-b138-d76bbe9f83e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T07:05:10.000Z",
      "valid_until": "2026-05-20T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-18T06:10:51.953Z",
      "x_nadsec_last_seen": "2026-04-18T06:10:51.953Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-18T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AU; asn=10143; asn_org=Exetel Pty Ltd",
      "id": "indicator--1f020564-3b8e-4e84-863d-20b222af760e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '58.96.54.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T07:05:10.000Z",
      "valid_until": "2026-05-20T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-18T06:52:42.603Z",
      "x_nadsec_last_seen": "2026-04-18T06:54:45.825Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "10143"
      ],
      "x_nadsec_orgs": [
        "Exetel Pty Ltd"
      ]
    },
    {
      "created": "2026-04-18T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--a739dc8d-86e9-4da0-9bb9-759ec09f5bb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.148.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T08:05:10.000Z",
      "valid_until": "2026-05-20T08:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-18T07:54:24.305Z",
      "x_nadsec_last_seen": "2026-04-18T07:55:09.359Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-18T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--61c2212f-108f-4a6e-b8ba-9092470f5423",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '171.225.216.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T08:05:10.000Z",
      "valid_until": "2026-05-20T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-17T17:51:44.697Z",
      "x_nadsec_last_seen": "2026-04-18T07:34:51.286Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-18T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--05d88a63-de14-4914-aa56-9c10af3d3c15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.158.228.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T08:05:10.000Z",
      "valid_until": "2026-05-20T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-18T07:47:01.891Z",
      "x_nadsec_last_seen": "2026-04-18T07:55:32.277Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-18T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--f5a06fcc-bba3-4b3d-a529-d4720a9c6fab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T08:05:10.000Z",
      "valid_until": "2026-05-20T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-18T07:51:54.639Z",
      "x_nadsec_last_seen": "2026-04-18T07:51:54.639Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-18T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=29456; asn_org=Rostelecom",
      "id": "indicator--24213a70-2556-4fbe-8a55-6ca7c8c97ac9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '82.151.98.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T08:05:10.000Z",
      "valid_until": "2026-05-20T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-18T07:21:14.140Z",
      "x_nadsec_last_seen": "2026-04-18T07:23:20.978Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "29456"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-18T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--dd67f146-9fab-4b29-b178-3f9d94ac550f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T08:05:10.000Z",
      "valid_until": "2026-05-20T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-18T07:18:52.100Z",
      "x_nadsec_last_seen": "2026-04-18T07:18:52.100Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-18T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--335ba962-161f-4936-b422-1aa824bfc4cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T08:05:10.000Z",
      "valid_until": "2026-05-20T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-18T07:57:20.591Z",
      "x_nadsec_last_seen": "2026-04-18T07:57:20.591Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-18T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--3265cdb1-ad93-4e15-a56b-f9a645f1916b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T08:05:10.000Z",
      "valid_until": "2026-05-20T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-18T07:25:09.446Z",
      "x_nadsec_last_seen": "2026-04-18T07:25:09.446Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-18T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--d9045946-83ad-4432-acc8-64fedeb4da8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T09:05:10.000Z",
      "valid_until": "2026-05-20T09:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-18T08:36:42.797Z",
      "x_nadsec_last_seen": "2026-04-19T20:44:12.204Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-18T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=ftpd; ports=21; cc=US; asn=174; asn_org=Cogent Communications, LLC",
      "id": "indicator--9f24a41c-a86f-4421-9188-fec5419f3950",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '38.123.94.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T09:05:10.000Z",
      "valid_until": "2026-05-20T09:05:08.000Z",
      "x_nadsec_event_count": 21,
      "x_nadsec_first_seen": "2026-04-05T01:11:13.617Z",
      "x_nadsec_last_seen": "2026-04-23T16:08:26.976Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "1433",
        "3306",
        "35581",
        "42567",
        "42805"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "174"
      ],
      "x_nadsec_orgs": [
        "Cogent Communications, LLC"
      ]
    },
    {
      "created": "2026-04-18T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--bb1a1ebd-7b65-4b82-a44b-83d0452499a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T09:05:10.000Z",
      "valid_until": "2026-05-20T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-18T08:32:32.122Z",
      "x_nadsec_last_seen": "2026-04-28T04:33:24.321Z",
      "x_nadsec_ports": [
        "445",
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-18T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--366fcfb2-1aac-4d2a-bf4c-f03f882c942c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T09:05:10.000Z",
      "valid_until": "2026-05-20T09:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-18T08:31:26.236Z",
      "x_nadsec_last_seen": "2026-04-28T11:26:39.246Z",
      "x_nadsec_ports": [
        "135",
        "1433",
        "1723"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-18T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--6f28a15b-b93d-4dc2-b5a1-fa9e00477240",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.119.26.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T10:05:13.000Z",
      "valid_until": "2026-05-20T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-18T09:39:50.325Z",
      "x_nadsec_last_seen": "2026-04-18T09:40:00.485Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-18T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--ead2ed66-25dc-45f5-b6b8-662ba9e06935",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.84.202.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T10:05:13.000Z",
      "valid_until": "2026-05-20T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-18T09:46:32.389Z",
      "x_nadsec_last_seen": "2026-04-18T09:46:32.389Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-18T12:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=10029; asn_org=SHYAM SPECTRA PVT LTD",
      "id": "indicator--aa9925e8-0dd9-4528-a99f-1f230dd55022",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T12:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '180.151.247.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T12:05:04.000Z",
      "valid_until": "2026-05-20T12:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-18T11:38:02.185Z",
      "x_nadsec_last_seen": "2026-04-18T11:44:33.021Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "10029"
      ],
      "x_nadsec_orgs": [
        "SHYAM SPECTRA PVT LTD"
      ]
    },
    {
      "created": "2026-04-18T12:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IQ; asn=206206; asn_org=Kurdistan Net Company for Computer and Internet Ltd.",
      "id": "indicator--37ea87a9-7096-4771-b54a-f7d82a80fc5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T12:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '212.237.124.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T12:05:04.000Z",
      "valid_until": "2026-05-20T12:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-18T11:56:43.308Z",
      "x_nadsec_last_seen": "2026-04-18T12:03:57.232Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IQ"
      ],
      "x_nadsec_asns": [
        "206206"
      ],
      "x_nadsec_orgs": [
        "Kurdistan Net Company for Computer and Internet Ltd."
      ]
    },
    {
      "created": "2026-04-18T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--298c9895-4d5a-420f-9731-dcee96b62c85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T13:05:11.000Z",
      "valid_until": "2026-05-20T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-18T12:11:34.081Z",
      "x_nadsec_last_seen": "2026-04-18T12:11:34.081Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-18T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--cdb60703-ebca-429c-a4a9-e0fa50389d3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.148.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T13:05:11.000Z",
      "valid_until": "2026-05-20T13:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-18T12:56:44.208Z",
      "x_nadsec_last_seen": "2026-04-18T12:57:29.299Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-18T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--2dcb33ac-168f-4545-a9ad-2f1123c68a9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '2.88.185.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T13:05:11.000Z",
      "valid_until": "2026-05-20T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-18T12:34:22.148Z",
      "x_nadsec_last_seen": "2026-04-18T12:36:28.624Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-04-18T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=132445; asn_org=Khetan Cable Network Pvt. Limited",
      "id": "indicator--f364dbbc-4fa9-4153-86fe-cb7c49032ac0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.21.55.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T14:05:11.000Z",
      "valid_until": "2026-05-20T14:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-18T13:32:53.631Z",
      "x_nadsec_last_seen": "2026-04-23T17:12:48.812Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132445"
      ],
      "x_nadsec_orgs": [
        "Khetan Cable Network Pvt. Limited"
      ]
    },
    {
      "created": "2026-04-18T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a15af852-5deb-408f-9f9d-acc17ab753c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '128.203.204.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T14:05:11.000Z",
      "valid_until": "2026-05-20T14:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-18T13:29:47.528Z",
      "x_nadsec_last_seen": "2026-04-18T13:29:47.528Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-18T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--e0b0ce70-ab86-4dd0-b235-14c74d36cd69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '171.234.8.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T14:05:11.000Z",
      "valid_until": "2026-05-20T14:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-18T13:41:22.892Z",
      "x_nadsec_last_seen": "2026-04-18T13:48:21.662Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-18T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--32b39aae-4a43-4089-aa48-d1e41fb7db63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.57.93.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T14:05:11.000Z",
      "valid_until": "2026-05-20T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-18T13:41:09.566Z",
      "x_nadsec_last_seen": "2026-04-18T13:43:17.033Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-04-18T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--1167d666-2544-4b6c-9714-3a64b9587753",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.105.248.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T14:05:11.000Z",
      "valid_until": "2026-05-20T14:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-18T13:09:32.632Z",
      "x_nadsec_last_seen": "2026-04-18T13:09:35.667Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-18T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=GE; asn=16010; asn_org=Magticom Ltd.",
      "id": "indicator--048d1db3-e15b-4676-bb2b-af1626886e8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '95.104.26.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T14:05:11.000Z",
      "valid_until": "2026-05-20T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-18T13:55:46.151Z",
      "x_nadsec_last_seen": "2026-04-18T13:57:52.871Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "16010"
      ],
      "x_nadsec_orgs": [
        "Magticom Ltd."
      ]
    },
    {
      "created": "2026-04-18T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=TW; asn=55720; asn_org=Gigabit Hosting Sdn Bhd; user(top)=r**t",
      "id": "indicator--cb0e5d61-8f5d-400e-b24f-b4c068e007c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.230.144.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T15:05:10.000Z",
      "valid_until": "2026-05-20T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-18T14:40:52.833Z",
      "x_nadsec_last_seen": "2026-04-18T14:40:52.833Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "55720"
      ],
      "x_nadsec_orgs": [
        "Gigabit Hosting Sdn Bhd"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-18T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--20b48abe-f78c-4afc-b3ae-480a26a5191f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.205.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T15:05:10.000Z",
      "valid_until": "2026-05-20T15:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-18T14:16:28.246Z",
      "x_nadsec_last_seen": "2026-04-18T14:17:17.632Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-18T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--8425456b-dd07-4abb-94d3-1fc57d90ce45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T15:05:10.000Z",
      "valid_until": "2026-05-20T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-18T14:57:01.837Z",
      "x_nadsec_last_seen": "2026-04-18T14:57:02.112Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-18T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--24a6ed5b-7080-4516-9e79-8bba6c0273e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.132.120.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T16:05:11.000Z",
      "valid_until": "2026-05-20T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-18T15:55:54.666Z",
      "x_nadsec_last_seen": "2026-04-18T15:58:02.099Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-04-18T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--e77ec328-c2d2-4895-82d8-0e187c40d32b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.193.57.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T17:05:11.000Z",
      "valid_until": "2026-05-20T17:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-18T16:55:34.139Z",
      "x_nadsec_last_seen": "2026-04-18T16:56:18.206Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-18T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC; user(top)=**",
      "id": "indicator--a12ae7fd-bda2-4d77-933f-33e8334ac918",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.56.98.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T17:05:11.000Z",
      "valid_until": "2026-05-20T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-18T16:10:44.448Z",
      "x_nadsec_last_seen": "2026-04-18T16:10:44.448Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-18T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--02bba0c9-226d-4421-a208-a5c26ee83d24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.228.42.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T17:05:11.000Z",
      "valid_until": "2026-05-20T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-18T16:06:40.351Z",
      "x_nadsec_last_seen": "2026-04-18T16:06:40.351Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-18T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--858fa6e3-5df3-4729-b77e-7989f7a6dd20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.176.70.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T19:05:11.000Z",
      "valid_until": "2026-05-20T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-18T18:11:09.287Z",
      "x_nadsec_last_seen": "2026-04-18T18:11:09.287Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-18T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--574e3ea6-25d1-4e81-803b-b6dc7714bb14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.182.217.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T19:05:11.000Z",
      "valid_until": "2026-05-20T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-18T18:06:45.338Z",
      "x_nadsec_last_seen": "2026-04-18T18:06:56.617Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-18T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--b49141f3-d7e7-4f7b-b1ee-f1ef1d3904ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.236.77.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T19:05:11.000Z",
      "valid_until": "2026-05-20T19:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-18T18:31:25.080Z",
      "x_nadsec_last_seen": "2026-04-21T23:30:16.492Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-04-18T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=9905; asn_org=Linknet ASN",
      "id": "indicator--7e2be634-ae49-4fe2-b3e3-fdcceed64746",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '202.77.109.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T19:05:11.000Z",
      "valid_until": "2026-05-20T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-18T18:45:02.726Z",
      "x_nadsec_last_seen": "2026-04-18T18:47:28.761Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9905"
      ],
      "x_nadsec_orgs": [
        "Linknet ASN"
      ]
    },
    {
      "created": "2026-04-18T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=epmapper; ports=135; cc=US; asn=701; asn_org=Verizon Business",
      "id": "indicator--7a7534be-d5b2-4eab-bd38-d685a217276f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.217.159.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T19:05:11.000Z",
      "valid_until": "2026-05-20T19:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-18T18:11:51.688Z",
      "x_nadsec_last_seen": "2026-04-24T23:54:12.795Z",
      "x_nadsec_ports": [
        "135",
        "445"
      ],
      "x_nadsec_services": [
        "epmapper",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "701"
      ],
      "x_nadsec_orgs": [
        "Verizon Business"
      ]
    },
    {
      "created": "2026-04-18T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=22773; asn_org=Cox Communications Inc.",
      "id": "indicator--72f50112-7db2-45d3-8ad4-3ed18c24787d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '98.175.167.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T19:05:11.000Z",
      "valid_until": "2026-05-20T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-18T18:36:40.384Z",
      "x_nadsec_last_seen": "2026-04-18T18:38:46.176Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "22773"
      ],
      "x_nadsec_orgs": [
        "Cox Communications Inc."
      ]
    },
    {
      "created": "2026-04-18T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--0e6f4557-bab7-4315-a42e-6d2ed61ed4c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.193.44.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T20:05:10.000Z",
      "valid_until": "2026-05-20T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-18T19:21:25.830Z",
      "x_nadsec_last_seen": "2026-04-18T19:21:25.830Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-18T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GE; asn=35805; asn_org=JSC Silknet",
      "id": "indicator--1ebb64e2-8bf5-4838-93c3-ba652ec1cdbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.255.242.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T20:05:10.000Z",
      "valid_until": "2026-05-20T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-18T19:50:54.854Z",
      "x_nadsec_last_seen": "2026-04-18T19:53:02.669Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "35805"
      ],
      "x_nadsec_orgs": [
        "JSC Silknet"
      ]
    },
    {
      "created": "2026-04-18T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--c119702c-2f0f-45f3-a635-2f3a618375b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T20:05:10.000Z",
      "valid_until": "2026-05-20T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-18T19:38:45.082Z",
      "x_nadsec_last_seen": "2026-04-18T19:38:45.082Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-18T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--40b41990-12ce-42de-8e33-4351d78c5ac4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.183.31.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T20:05:10.000Z",
      "valid_until": "2026-05-20T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-18T19:29:18.441Z",
      "x_nadsec_last_seen": "2026-04-18T19:29:18.441Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-18T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--a3908727-dbaf-4db2-85c7-b4cb9b9feb49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.170.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T21:05:10.000Z",
      "valid_until": "2026-05-20T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-18T21:04:39.029Z",
      "x_nadsec_last_seen": "2026-04-18T21:04:39.029Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-18T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b81e65de-3473-4f1b-8d9e-2153d1915435",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T21:05:10.000Z",
      "valid_until": "2026-05-20T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-18T20:24:59.854Z",
      "x_nadsec_last_seen": "2026-04-22T20:12:17.781Z",
      "x_nadsec_ports": [
        "445",
        "135"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-18T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MG; asn=37037; asn_org=Orange Madagascar; user(top)=**",
      "id": "indicator--9bcb2f05-0c4d-4bc1-96d5-5d191d4dc5b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.63.156.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T21:05:10.000Z",
      "valid_until": "2026-05-20T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-18T20:26:01.503Z",
      "x_nadsec_last_seen": "2026-04-18T20:26:01.503Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MG"
      ],
      "x_nadsec_asns": [
        "37037"
      ],
      "x_nadsec_orgs": [
        "Orange Madagascar"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-18T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4847; asn_org=China Networks Inter-Exchange",
      "id": "indicator--e1e268cb-85da-49ee-927f-97de933ed104",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '106.39.36.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T22:05:10.000Z",
      "valid_until": "2026-05-20T22:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-18T22:04:42.076Z",
      "x_nadsec_last_seen": "2026-04-18T22:13:17.907Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4847"
      ],
      "x_nadsec_orgs": [
        "China Networks Inter-Exchange"
      ]
    },
    {
      "created": "2026-04-18T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--9342e684-8beb-42a7-9e75-5024d1d60c60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T22:05:10.000Z",
      "valid_until": "2026-05-20T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-18T21:29:58.304Z",
      "x_nadsec_last_seen": "2026-04-30T01:38:15.825Z",
      "x_nadsec_ports": [
        "1723",
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-18T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--afca8ae5-4ca2-4a20-b0a8-2788ba284969",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T22:05:10.000Z",
      "valid_until": "2026-05-20T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-18T21:20:44.634Z",
      "x_nadsec_last_seen": "2026-04-18T21:20:44.634Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-18T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b605c88a-858d-4d8b-8603-5d432b4ed368",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T22:05:10.000Z",
      "valid_until": "2026-05-20T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-05T00:11:34.308Z",
      "x_nadsec_last_seen": "2026-04-18T21:54:43.387Z",
      "x_nadsec_ports": [
        "21",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-18T23:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--92da88d8-0b64-4801-9238-004f1e1887e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T23:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.134.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T23:05:06.000Z",
      "valid_until": "2026-05-20T23:05:04.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-18T22:56:08.910Z",
      "x_nadsec_last_seen": "2026-04-18T22:56:53.834Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-18T23:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--9679de4d-3fbc-497e-a138-4f2a5ae5ab81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T23:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.152.148.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T23:05:06.000Z",
      "valid_until": "2026-05-20T23:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-18T22:11:34.251Z",
      "x_nadsec_last_seen": "2026-04-18T22:18:18.208Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-04-18T23:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--f2e0d695-1efb-4872-9903-6dc590872055",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T23:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.250.80.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T23:05:06.000Z",
      "valid_until": "2026-05-20T23:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-18T22:35:25.043Z",
      "x_nadsec_last_seen": "2026-04-18T22:35:25.043Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-19T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=epmapper; ports=135; cc=ZA; asn=37100; asn_org=SEACOM-AS",
      "id": "indicator--7d8cf953-9e2a-4284-8d4c-ff6fe23a99b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '105.27.115.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T00:05:11.000Z",
      "valid_until": "2026-05-21T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-18T23:58:05.813Z",
      "x_nadsec_last_seen": "2026-04-18T23:58:08.730Z",
      "x_nadsec_ports": [
        "135",
        "445"
      ],
      "x_nadsec_services": [
        "epmapper",
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "37100"
      ],
      "x_nadsec_orgs": [
        "SEACOM-AS"
      ]
    },
    {
      "created": "2026-04-19T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ES; asn=12479; asn_org=Orange Espagne SA",
      "id": "indicator--41c02dca-df06-4ab4-ac6e-158ef48c106e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.50.194.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T00:05:11.000Z",
      "valid_until": "2026-05-21T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-18T23:58:05.907Z",
      "x_nadsec_last_seen": "2026-04-18T23:58:05.958Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "12479"
      ],
      "x_nadsec_orgs": [
        "Orange Espagne SA"
      ]
    },
    {
      "created": "2026-04-19T01:05:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--e2d2c126-cf06-4835-849c-183131a1b723",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T01:05:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.193.57.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T01:05:31.000Z",
      "valid_until": "2026-05-21T01:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-19T00:40:21.054Z",
      "x_nadsec_last_seen": "2026-04-19T00:40:43.702Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-19T01:05:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--dbf6c579-efa9-4305-be6c-2c87f954d59c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T01:05:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.171.23.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T01:05:31.000Z",
      "valid_until": "2026-05-21T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T00:49:20.074Z",
      "x_nadsec_last_seen": "2026-04-19T00:49:20.074Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-19T01:05:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--3c234710-502b-4f95-b70f-167bdcf599fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T01:05:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.227.152.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T01:05:31.000Z",
      "valid_until": "2026-05-21T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T01:03:02.832Z",
      "x_nadsec_last_seen": "2026-04-19T01:03:02.832Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-19T01:05:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--fcfc1e0d-0410-4991-9783-d3bab88da479",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T01:05:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T01:05:31.000Z",
      "valid_until": "2026-05-21T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T00:36:11.922Z",
      "x_nadsec_last_seen": "2026-04-19T00:36:11.922Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-19T01:05:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--c2c267df-435f-41ae-97cf-2d50e56766d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T01:05:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T01:05:31.000Z",
      "valid_until": "2026-05-21T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T00:25:44.172Z",
      "x_nadsec_last_seen": "2026-04-19T00:25:44.172Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-19T02:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--bac3316f-2f45-44c8-979e-4f9ae1c4c51f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T02:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '124.29.194.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T02:05:05.000Z",
      "valid_until": "2026-05-21T02:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T01:06:33.862Z",
      "x_nadsec_last_seen": "2026-04-19T01:06:33.862Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ]
    },
    {
      "created": "2026-04-19T02:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--8bf5a8b9-f792-4f98-b347-fc94c3ef6e0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T02:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.148.5.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T02:05:05.000Z",
      "valid_until": "2026-05-21T02:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T01:32:50.104Z",
      "x_nadsec_last_seen": "2026-04-19T01:32:50.104Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-19T02:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--5b1b802f-e04a-4b97-ab45-fb174480c3bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T02:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.134.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T02:05:05.000Z",
      "valid_until": "2026-05-21T02:05:03.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-19T01:19:35.200Z",
      "x_nadsec_last_seen": "2026-04-28T21:25:28.251Z",
      "x_nadsec_ports": [
        "445",
        "81"
      ],
      "x_nadsec_services": [
        "smbd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-19T02:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--58153ae2-ec6e-49d8-88ad-2272b7ddafd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T02:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.232.138.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T02:05:05.000Z",
      "valid_until": "2026-05-21T02:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-19T01:55:23.599Z",
      "x_nadsec_last_seen": "2026-04-28T19:30:13.011Z",
      "x_nadsec_ports": [
        "445",
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-19T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--30f94b75-da7a-4498-b5c1-f29968bdc7d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.149.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T03:05:10.000Z",
      "valid_until": "2026-05-21T03:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-19T02:40:31.123Z",
      "x_nadsec_last_seen": "2026-04-19T02:41:21.671Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-19T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=JP; asn=7672; asn_org=Hokuden Information System Service Co.,Ltd.; user(top)=**",
      "id": "indicator--3cda96d9-55ee-42f4-b948-33fbc734717a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '210.171.212.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T03:05:10.000Z",
      "valid_until": "2026-05-21T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-11T15:54:06.892Z",
      "x_nadsec_last_seen": "2026-04-26T19:01:28.743Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "7672"
      ],
      "x_nadsec_orgs": [
        "Hokuden Information System Service Co.,Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-19T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US",
      "id": "indicator--37f80b0f-3f56-48c5-b0e6-85db0e6cae52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.39.12.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T03:05:10.000Z",
      "valid_until": "2026-05-21T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T02:31:46.958Z",
      "x_nadsec_last_seen": "2026-04-19T02:31:46.958Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ]
    },
    {
      "created": "2026-04-19T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US",
      "id": "indicator--40bbb763-3eda-4bfd-8262-3fee2d96bd77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.39.12.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T03:05:10.000Z",
      "valid_until": "2026-05-21T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T02:32:06.555Z",
      "x_nadsec_last_seen": "2026-04-19T02:32:06.555Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ]
    },
    {
      "created": "2026-04-19T04:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--c6dde758-5beb-46e0-897f-09f58d6fc3f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T04:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.41.31.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T04:05:08.000Z",
      "valid_until": "2026-05-21T04:05:07.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-19T03:53:34.611Z",
      "x_nadsec_last_seen": "2026-04-19T03:53:35.584Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-19T04:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--623620d5-b9be-47dc-8083-b4c4381f431f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T04:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '125.26.15.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T04:05:08.000Z",
      "valid_until": "2026-05-21T04:05:07.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-19T03:51:57.058Z",
      "x_nadsec_last_seen": "2026-04-19T03:58:15.919Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-04-19T04:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--4cae8e00-6374-47f8-8ea4-2131a3692116",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T04:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.182.151.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T04:05:08.000Z",
      "valid_until": "2026-05-21T04:05:07.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-19T03:19:47.998Z",
      "x_nadsec_last_seen": "2026-04-19T03:19:51.222Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-19T04:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=SC; asn=150706; asn_org=Hong Kong Zhengxing Technology Co., Ltd.",
      "id": "indicator--7dd6d80f-c28c-44fd-ae51-24a89748ff7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T04:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.218.7.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T04:05:08.000Z",
      "valid_until": "2026-05-21T04:05:07.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-19T03:16:11.588Z",
      "x_nadsec_last_seen": "2026-04-19T03:22:27.918Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "150706"
      ],
      "x_nadsec_orgs": [
        "Hong Kong Zhengxing Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-19T04:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--1b4ab715-155c-438b-a6c9-dbf3cddfc88e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T04:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.202.118.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T04:05:08.000Z",
      "valid_until": "2026-05-21T04:05:07.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T03:21:25.343Z",
      "x_nadsec_last_seen": "2026-04-19T03:21:25.343Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-19T04:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--1284dfe8-8919-4764-a6dd-c56c2734c261",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T04:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.118.227.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T04:05:08.000Z",
      "valid_until": "2026-05-21T04:05:07.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-19T03:38:42.059Z",
      "x_nadsec_last_seen": "2026-04-19T03:38:52.232Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-19T04:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--47ae71a6-bb97-460d-9340-9c7b67722793",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T04:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.53.158.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T04:05:08.000Z",
      "valid_until": "2026-05-21T04:05:07.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-19T04:00:35.851Z",
      "x_nadsec_last_seen": "2026-04-27T12:35:19.801Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-04-19T04:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--213bb2d8-8c08-47d7-8ec2-8c323dc58436",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T04:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T04:05:08.000Z",
      "valid_until": "2026-05-21T04:05:07.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T03:23:08.677Z",
      "x_nadsec_last_seen": "2026-04-19T03:23:08.677Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-19T04:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--14febb6f-7b68-4a3c-9d38-5478f8ffa2f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T04:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T04:05:08.000Z",
      "valid_until": "2026-05-21T04:05:07.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T03:29:57.872Z",
      "x_nadsec_last_seen": "2026-04-19T03:29:57.872Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-19T04:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--afb3b5f6-d5f8-4862-bf8b-8cb4d3b1a378",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T04:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T04:05:08.000Z",
      "valid_until": "2026-05-21T04:05:07.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T03:29:58.173Z",
      "x_nadsec_last_seen": "2026-04-19T03:29:58.173Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-19T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=4800; asn_org=PT Aplikanusa Lintasarta",
      "id": "indicator--6301f74e-0ac0-4830-9bf5-d5883e05cc0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '123.231.151.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T05:05:07.000Z",
      "valid_until": "2026-05-21T05:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-19T04:30:16.434Z",
      "x_nadsec_last_seen": "2026-04-19T04:32:20.245Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "4800"
      ],
      "x_nadsec_orgs": [
        "PT Aplikanusa Lintasarta"
      ]
    },
    {
      "created": "2026-04-19T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--dc1b93c3-dd1f-4125-acee-9e5145e983cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.247.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T05:05:07.000Z",
      "valid_until": "2026-05-21T05:05:03.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-19T04:16:13.349Z",
      "x_nadsec_last_seen": "2026-04-19T04:16:57.413Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-19T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CO; asn=3816; asn_org=COLOMBIA TELECOMUNICACIONES S.A. ESP BIC; user(top)=**",
      "id": "indicator--6cda5f80-c39d-45ef-a40b-37a789b30b6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.66.196.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T05:05:07.000Z",
      "valid_until": "2026-05-21T05:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T04:53:04.681Z",
      "x_nadsec_last_seen": "2026-04-19T04:53:04.681Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "3816"
      ],
      "x_nadsec_orgs": [
        "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-19T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--9efc7aa3-38f1-4111-87aa-88ab9df18ab0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.168.7.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T05:05:07.000Z",
      "valid_until": "2026-05-21T05:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T04:35:13.186Z",
      "x_nadsec_last_seen": "2026-04-19T04:35:13.186Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-19T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--19220024-6538-43b3-9674-67a5bfb48e82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.124.168.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T05:05:07.000Z",
      "valid_until": "2026-05-21T05:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-19T04:44:08.434Z",
      "x_nadsec_last_seen": "2026-04-19T04:44:08.816Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-19T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=NL; asn=49870; asn_org=Alsycon B.V.; user(top)=c**n",
      "id": "indicator--c75f5408-9d18-48b4-ab9e-5578c620d663",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '89.190.156.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T05:05:07.000Z",
      "valid_until": "2026-05-21T05:05:03.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-19T05:03:20.354Z",
      "x_nadsec_last_seen": "2026-04-23T22:31:01.584Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ],
      "x_nadsec_usernames_attempted": [
        "c**n"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-19T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=48524; asn_org=INTERRA telecommunications group, Ltd.",
      "id": "indicator--414bd078-d019-463e-886c-706af1e14706",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.190.68.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T05:05:07.000Z",
      "valid_until": "2026-05-21T05:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-19T04:18:34.025Z",
      "x_nadsec_last_seen": "2026-04-19T04:19:49.693Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48524"
      ],
      "x_nadsec_orgs": [
        "INTERRA telecommunications group, Ltd."
      ]
    },
    {
      "created": "2026-04-19T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--8fffe8e4-edc5-41e6-82e4-cf3b8fcd2df6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '159.89.184.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T07:05:10.000Z",
      "valid_until": "2026-05-21T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T06:14:37.245Z",
      "x_nadsec_last_seen": "2026-04-19T06:14:37.245Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-19T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e87370b5-a40c-4dda-b7a3-79eb8c13519a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T07:05:10.000Z",
      "valid_until": "2026-05-21T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T06:29:47.218Z",
      "x_nadsec_last_seen": "2026-04-19T06:29:47.218Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-19T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--af2e0c96-e532-4a72-800b-97aef2a2d6b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T07:05:10.000Z",
      "valid_until": "2026-05-21T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-19T06:31:29.048Z",
      "x_nadsec_last_seen": "2026-04-21T08:31:51.707Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-19T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--375bbac7-8d08-412d-b3db-8f04f737243c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T07:05:10.000Z",
      "valid_until": "2026-05-21T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-11T07:09:02.977Z",
      "x_nadsec_last_seen": "2026-04-19T06:47:31.607Z",
      "x_nadsec_ports": [
        "81",
        "1723"
      ],
      "x_nadsec_services": [
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-19T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrord; ports=42; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--15a64419-a669-4da4-8083-ea0e0bb8d747",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T07:05:10.000Z",
      "valid_until": "2026-05-21T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-19T06:44:19.921Z",
      "x_nadsec_last_seen": "2026-04-19T06:44:19.924Z",
      "x_nadsec_ports": [
        "42",
        "38373"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-19T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--749c94b2-8357-4623-b887-b80713402e5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T07:05:10.000Z",
      "valid_until": "2026-05-21T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T06:22:59.518Z",
      "x_nadsec_last_seen": "2026-04-19T06:22:59.518Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-19T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--b89711db-d043-4b8d-a6ca-2bd707434a0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T07:05:10.000Z",
      "valid_until": "2026-05-21T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T06:22:59.198Z",
      "x_nadsec_last_seen": "2026-04-19T06:22:59.198Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-19T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=76; services=smbd; ports=445; cc=GB; asn=201579; asn_org=Hostgnome Ltd",
      "id": "indicator--afc6b207-6083-49f1-b61b-262f098ff38f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.237.124.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T07:05:10.000Z",
      "valid_until": "2026-05-21T07:05:09.000Z",
      "x_nadsec_event_count": 137,
      "x_nadsec_first_seen": "2026-04-19T06:39:07.106Z",
      "x_nadsec_last_seen": "2026-04-19T07:18:34.710Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "201579"
      ],
      "x_nadsec_orgs": [
        "Hostgnome Ltd"
      ]
    },
    {
      "created": "2026-04-19T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=23700; asn_org=Linknet-Fastnet ASN",
      "id": "indicator--7557c13a-9e93-4176-b65d-65ec9cac8184",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '139.0.69.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T09:05:10.000Z",
      "valid_until": "2026-05-21T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-19T08:36:01.587Z",
      "x_nadsec_last_seen": "2026-04-19T08:42:44.762Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23700"
      ],
      "x_nadsec_orgs": [
        "Linknet-Fastnet ASN"
      ]
    },
    {
      "created": "2026-04-19T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PE; asn=6147; asn_org=INTEGRATEL PERU S.A.A.; user(top)=**",
      "id": "indicator--b20160a4-9b16-4bda-b1c1-3fd77abad7d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.239.208.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T09:05:10.000Z",
      "valid_until": "2026-05-21T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T08:37:21.159Z",
      "x_nadsec_last_seen": "2026-04-19T08:37:21.159Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "6147"
      ],
      "x_nadsec_orgs": [
        "INTEGRATEL PERU S.A.A."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-19T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=RU; asn=57529; asn_org=ZAO GTNT",
      "id": "indicator--51c1cbaf-2227-494c-8518-4607eeed1086",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.19.51.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T09:05:10.000Z",
      "valid_until": "2026-05-21T09:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-19T08:10:52.766Z",
      "x_nadsec_last_seen": "2026-04-19T08:12:08.230Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "57529"
      ],
      "x_nadsec_orgs": [
        "ZAO GTNT"
      ]
    },
    {
      "created": "2026-04-19T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IL; asn=208905; asn_org=Exelera Telecom Ltd",
      "id": "indicator--59db7695-09bd-43b9-a715-15213eb065c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '213.146.169.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T09:05:10.000Z",
      "valid_until": "2026-05-21T09:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-19T08:06:43.269Z",
      "x_nadsec_last_seen": "2026-04-19T08:08:49.648Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IL"
      ],
      "x_nadsec_asns": [
        "208905"
      ],
      "x_nadsec_orgs": [
        "Exelera Telecom Ltd"
      ]
    },
    {
      "created": "2026-04-19T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IL; asn=12849; asn_org=Hot-Net internet services Ltd.",
      "id": "indicator--4761c681-5330-4664-997a-1fa024b31f9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.142.122.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T09:05:10.000Z",
      "valid_until": "2026-05-21T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T08:08:48.065Z",
      "x_nadsec_last_seen": "2026-04-19T08:08:48.065Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IL"
      ],
      "x_nadsec_asns": [
        "12849"
      ],
      "x_nadsec_orgs": [
        "Hot-Net internet services Ltd."
      ]
    },
    {
      "created": "2026-04-19T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--84855b8b-7957-45f2-a250-bb1a67064695",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.183.23.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T09:05:10.000Z",
      "valid_until": "2026-05-21T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T08:08:32.085Z",
      "x_nadsec_last_seen": "2026-04-19T08:08:32.085Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-19T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--f7428359-2e75-4bb1-b4b3-a1deb54a4a60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '124.235.224.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T10:05:02.000Z",
      "valid_until": "2026-05-21T10:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-19T09:13:20.377Z",
      "x_nadsec_last_seen": "2026-04-19T09:13:27.345Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-19T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH",
      "id": "indicator--58b45796-5717-4847-a33d-0405c224ab78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T10:05:02.000Z",
      "valid_until": "2026-05-21T10:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T09:28:11.847Z",
      "x_nadsec_last_seen": "2026-04-19T09:28:11.847Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "215778"
      ],
      "x_nadsec_orgs": [
        "Alpha Strike Labs GmbH"
      ]
    },
    {
      "created": "2026-04-19T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--78b36540-ea30-4a2a-8821-f21a28877b41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T10:05:02.000Z",
      "valid_until": "2026-05-21T10:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T10:00:09.283Z",
      "x_nadsec_last_seen": "2026-04-19T10:00:09.283Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-19T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=141805; asn_org=Hubcom Techno System Llp",
      "id": "indicator--c250564d-85cf-4391-af57-4e66a4d269e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.109.137.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T11:05:11.000Z",
      "valid_until": "2026-05-21T11:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-19T10:37:37.958Z",
      "x_nadsec_last_seen": "2026-04-19T10:37:38.174Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "141805"
      ],
      "x_nadsec_orgs": [
        "Hubcom Techno System Llp"
      ]
    },
    {
      "created": "2026-04-19T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=134420; asn_org=Chongqing Telecom",
      "id": "indicator--bed5125a-fb38-4077-b987-6919a92735a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '219.153.113.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T11:05:11.000Z",
      "valid_until": "2026-05-21T11:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T10:54:58.095Z",
      "x_nadsec_last_seen": "2026-04-19T10:54:58.095Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "134420"
      ],
      "x_nadsec_orgs": [
        "Chongqing Telecom"
      ]
    },
    {
      "created": "2026-04-19T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC; user(top)=**; pass(top)=1****6",
      "id": "indicator--7334991a-9df3-48cd-94f9-4a05ea0dc21b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.136.132.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T11:05:11.000Z",
      "valid_until": "2026-05-21T11:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-19T10:27:32.041Z",
      "x_nadsec_last_seen": "2026-04-21T03:20:37.200Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6"
      ]
    },
    {
      "created": "2026-04-19T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--b6b3d625-8c94-4d4c-8f81-90e2a6dc2973",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.251.165.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T11:05:11.000Z",
      "valid_until": "2026-05-21T11:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T10:39:06.586Z",
      "x_nadsec_last_seen": "2026-04-19T10:39:06.586Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-19T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=38778; asn_org=PT. Dutakom Wibawa Putra",
      "id": "indicator--f4a30457-e76f-4841-9c07-f560d7f73c66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '115.69.223.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T12:05:10.000Z",
      "valid_until": "2026-05-21T12:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T11:42:49.011Z",
      "x_nadsec_last_seen": "2026-04-19T11:42:49.011Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "38778"
      ],
      "x_nadsec_orgs": [
        "PT. Dutakom Wibawa Putra"
      ]
    },
    {
      "created": "2026-04-19T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=26599; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--063373f2-1573-4e8e-ae68-b4e4160d5c40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '191.9.113.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T12:05:10.000Z",
      "valid_until": "2026-05-21T12:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-19T11:10:59.152Z",
      "x_nadsec_last_seen": "2026-04-19T11:13:06.332Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "26599"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-04-19T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=3215; asn_org=Orange",
      "id": "indicator--0aa77709-ecaa-44e3-9d54-34444ef563e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.250.243.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T12:05:10.000Z",
      "valid_until": "2026-05-21T12:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T11:49:52.898Z",
      "x_nadsec_last_seen": "2026-04-19T11:49:52.898Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "3215"
      ],
      "x_nadsec_orgs": [
        "Orange"
      ]
    },
    {
      "created": "2026-04-19T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--a4b4ef22-c895-490f-8d1f-5cfc1dc417d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.67.127.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T12:05:10.000Z",
      "valid_until": "2026-05-21T12:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-19T11:38:26.077Z",
      "x_nadsec_last_seen": "2026-04-19T11:44:53.348Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-19T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=18; services=smbd; ports=445; cc=FR; asn=16276; asn_org=OVH SAS",
      "id": "indicator--d8f58dab-52c3-43d3-bb9a-3724a3ebfa54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.31.157.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T13:05:11.000Z",
      "valid_until": "2026-05-21T13:05:09.000Z",
      "x_nadsec_event_count": 18,
      "x_nadsec_first_seen": "2026-04-19T12:36:53.780Z",
      "x_nadsec_last_seen": "2026-04-19T12:40:56.937Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ]
    },
    {
      "created": "2026-04-19T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BD; asn=23893; asn_org=Bangla Phone Ltd; user(top)=**",
      "id": "indicator--703cbe1d-3d51-427a-965e-4cd111da2d6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '180.210.128.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T13:05:11.000Z",
      "valid_until": "2026-05-21T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T12:26:26.216Z",
      "x_nadsec_last_seen": "2026-04-19T12:26:26.216Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "23893"
      ],
      "x_nadsec_orgs": [
        "Bangla Phone Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-19T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--70779bd5-a1ef-4c42-a284-efcdff2b2642",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.163.16.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T13:05:11.000Z",
      "valid_until": "2026-05-21T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-19T12:45:52.969Z",
      "x_nadsec_last_seen": "2026-04-19T12:46:03.112Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-19T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--9e08cc7e-0ef3-405f-9d9a-15a0ad89434e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.241.211.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T13:05:11.000Z",
      "valid_until": "2026-05-21T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-19T12:36:13.454Z",
      "x_nadsec_last_seen": "2026-04-22T09:05:19.212Z",
      "x_nadsec_ports": [
        "445",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-19T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MA; asn=36903; asn_org=MT-MPLS; user(top)=**",
      "id": "indicator--3ac1c897-bbd5-4d34-b9d1-a3bb27298e05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.251.61.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T13:05:11.000Z",
      "valid_until": "2026-05-21T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T12:41:00.373Z",
      "x_nadsec_last_seen": "2026-04-19T12:41:00.373Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "36903"
      ],
      "x_nadsec_orgs": [
        "MT-MPLS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-19T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e4dc064e-0c84-4744-9fb9-98914006340d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.208.49.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T14:05:10.000Z",
      "valid_until": "2026-05-21T14:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-19T13:27:20.786Z",
      "x_nadsec_last_seen": "2026-04-26T18:08:20.906Z",
      "x_nadsec_ports": [
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-19T15:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--84078a98-4772-4d50-951c-ba36b7cbf7a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T15:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.119.97.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T15:05:17.000Z",
      "valid_until": "2026-05-21T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-19T14:21:44.948Z",
      "x_nadsec_last_seen": "2026-04-19T14:21:45.643Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-19T15:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=PK; asn=38264; asn_org=National WiMAXIMS environment",
      "id": "indicator--cb6dfcba-6d98-45e4-b153-5a371f003786",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T15:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '58.27.213.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T15:05:17.000Z",
      "valid_until": "2026-05-21T15:05:09.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-04-19T14:36:15.601Z",
      "x_nadsec_last_seen": "2026-04-19T14:39:12.343Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "38264"
      ],
      "x_nadsec_orgs": [
        "National WiMAXIMS environment"
      ]
    },
    {
      "created": "2026-04-19T15:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=51054; asn_org=OOO TransKom",
      "id": "indicator--20dea4cb-c3fe-4373-86aa-5a1d45490bac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T15:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '62.76.64.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T15:05:17.000Z",
      "valid_until": "2026-05-21T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-19T14:23:01.231Z",
      "x_nadsec_last_seen": "2026-04-19T14:23:01.321Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "51054"
      ],
      "x_nadsec_orgs": [
        "OOO TransKom"
      ]
    },
    {
      "created": "2026-04-19T15:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=34139; asn_org=JSC DIVO",
      "id": "indicator--143cb120-6321-42a5-bf90-b932c685b649",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T15:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '88.210.32.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T15:05:17.000Z",
      "valid_until": "2026-05-21T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-19T14:34:24.219Z",
      "x_nadsec_last_seen": "2026-04-19T14:34:25.190Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "34139"
      ],
      "x_nadsec_orgs": [
        "JSC DIVO"
      ]
    },
    {
      "created": "2026-04-19T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--fcb19b31-6cb8-4026-a1a4-a35c870cd913",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.181.116.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T16:05:10.000Z",
      "valid_until": "2026-05-21T16:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-19T15:18:36.380Z",
      "x_nadsec_last_seen": "2026-04-19T15:20:41.272Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-19T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--a411eb06-7d5d-4892-96c3-dc59e4701777",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.172.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T16:05:10.000Z",
      "valid_until": "2026-05-21T16:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-19T15:40:15.849Z",
      "x_nadsec_last_seen": "2026-04-24T06:31:44.794Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-19T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--1fe2f2ae-2266-444f-ae18-aafe3eea6320",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '123.16.213.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T17:05:10.000Z",
      "valid_until": "2026-05-21T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-19T16:37:31.836Z",
      "x_nadsec_last_seen": "2026-04-19T16:39:36.637Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-19T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--2414dd7e-ff90-4d7c-b699-0f14db5af2b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T17:05:10.000Z",
      "valid_until": "2026-05-21T17:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-19T17:04:37.250Z",
      "x_nadsec_last_seen": "2026-04-19T17:04:37.524Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-19T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--4d89fed2-e906-41d3-8b32-70e111821041",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T17:05:10.000Z",
      "valid_until": "2026-05-21T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T16:26:33.651Z",
      "x_nadsec_last_seen": "2026-04-19T16:26:33.651Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-19T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=50; services=pptpd; ports=1723; cc=US; asn=56971; asn_org=Cgi Global Limited",
      "id": "indicator--9f6716ca-f76d-44db-8384-758af0136cfe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '31.56.178.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T17:05:10.000Z",
      "valid_until": "2026-05-21T17:05:09.000Z",
      "x_nadsec_event_count": 50,
      "x_nadsec_first_seen": "2026-04-19T16:19:33.480Z",
      "x_nadsec_last_seen": "2026-04-19T16:19:34.832Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "56971"
      ],
      "x_nadsec_orgs": [
        "Cgi Global Limited"
      ]
    },
    {
      "created": "2026-04-19T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--664a5ff8-9965-4056-bc13-2ccbe31e95cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.173.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T18:05:10.000Z",
      "valid_until": "2026-05-21T18:05:08.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-19T17:45:45.365Z",
      "x_nadsec_last_seen": "2026-04-19T17:46:30.418Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-19T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--1abd1f32-209c-4df4-9cdc-86b8fbe919f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.202.118.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T18:05:10.000Z",
      "valid_until": "2026-05-21T18:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-19T17:22:21.355Z",
      "x_nadsec_last_seen": "2026-04-19T17:22:31.704Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-19T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=140311; asn_org=CHINATELECOM Guangdong province Jiangmen 5G network; user(top)=**",
      "id": "indicator--15c42677-6dc3-4ef7-ba17-f8cd15f49f62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '183.10.5.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T18:05:10.000Z",
      "valid_until": "2026-05-21T18:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T17:39:34.828Z",
      "x_nadsec_last_seen": "2026-04-19T17:39:34.828Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "140311"
      ],
      "x_nadsec_orgs": [
        "CHINATELECOM Guangdong province Jiangmen 5G network"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-19T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CO; asn=3816; asn_org=COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "id": "indicator--7fa03b88-b8ed-49a7-a39c-0dc7ca6d7a4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.113.255.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T18:05:10.000Z",
      "valid_until": "2026-05-21T18:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T17:53:28.408Z",
      "x_nadsec_last_seen": "2026-04-19T17:53:28.408Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "3816"
      ],
      "x_nadsec_orgs": [
        "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC"
      ]
    },
    {
      "created": "2026-04-19T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--040a475d-ff39-4169-9157-f523a9befc95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.84.153.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T18:05:10.000Z",
      "valid_until": "2026-05-21T18:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-19T17:51:40.574Z",
      "x_nadsec_last_seen": "2026-04-24T15:33:05.807Z",
      "x_nadsec_ports": [
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-19T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--cf4a5ed7-7a52-4528-a0f8-7b22fae21d14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.98.128.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T18:05:10.000Z",
      "valid_until": "2026-05-21T18:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T17:44:56.515Z",
      "x_nadsec_last_seen": "2026-04-19T17:44:56.515Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-19T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--68e740a0-1da7-4427-8763-0e63efb559bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T18:05:10.000Z",
      "valid_until": "2026-05-21T18:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T17:34:28.810Z",
      "x_nadsec_last_seen": "2026-04-19T17:34:28.810Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-19T19:05:18.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--51b20f52-ba8e-4e46-8ed9-a2a1b8ddf0b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T19:05:18.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.194.250.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T19:05:18.000Z",
      "valid_until": "2026-05-21T19:05:16.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T18:36:52.162Z",
      "x_nadsec_last_seen": "2026-04-19T18:36:52.162Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-19T19:05:18.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--9c15c10a-072a-409e-b447-d682d44914f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T19:05:18.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.237.127.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T19:05:18.000Z",
      "valid_until": "2026-05-21T19:05:16.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-19T18:17:08.233Z",
      "x_nadsec_last_seen": "2026-04-30T20:24:45.939Z",
      "x_nadsec_ports": [
        "1433",
        "1723"
      ],
      "x_nadsec_services": [
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-19T19:05:18.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mqttd; ports=1883; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--7743a080-7b04-404d-9a10-9de7e6882e8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T19:05:18.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.251.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T19:05:18.000Z",
      "valid_until": "2026-05-21T19:05:16.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-19T18:19:51.471Z",
      "x_nadsec_last_seen": "2026-04-19T18:20:20.593Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-19T19:05:18.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=SC; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--6ae49ffa-9a43-4da5-8539-f1ba4c750c43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T19:05:18.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T19:05:18.000Z",
      "valid_until": "2026-05-21T19:05:16.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-19T18:14:58.907Z",
      "x_nadsec_last_seen": "2026-04-23T11:46:30.271Z",
      "x_nadsec_ports": [
        "21",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-04-19T19:05:18.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=AE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--657372f6-5702-4f81-800e-2087d2a22193",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T19:05:18.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.12.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T19:05:18.000Z",
      "valid_until": "2026-05-21T19:05:16.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-19T18:49:15.180Z",
      "x_nadsec_last_seen": "2026-04-19T18:49:38.165Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-19T19:05:18.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TR; asn=12735; asn_org=TurkNet Iletisim Hizmetleri A.S.",
      "id": "indicator--5d8f1c97-e416-4f3b-ae50-c54d5ddc4b30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T19:05:18.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '31.223.4.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T19:05:18.000Z",
      "valid_until": "2026-05-21T19:05:16.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-19T18:50:48.526Z",
      "x_nadsec_last_seen": "2026-04-23T15:54:52.399Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "12735"
      ],
      "x_nadsec_orgs": [
        "TurkNet Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-04-19T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--6ded3c1d-bc1e-462b-ba85-d40d5c834a81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '112.119.55.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T20:05:11.000Z",
      "valid_until": "2026-05-21T20:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-19T19:30:34.465Z",
      "x_nadsec_last_seen": "2026-04-19T19:32:38.917Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-04-19T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--f1d118b0-4be1-4513-9797-a3fd7d9068c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '123.25.116.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T20:05:11.000Z",
      "valid_until": "2026-05-21T20:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-19T19:09:54.418Z",
      "x_nadsec_last_seen": "2026-04-19T19:16:40.011Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-19T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--55f16055-26ad-4695-9b0b-6364806e39ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.106.206.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T20:05:11.000Z",
      "valid_until": "2026-05-21T20:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T19:59:26.237Z",
      "x_nadsec_last_seen": "2026-04-19T19:59:26.237Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-19T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=48199; asn_org=Tehno-Pro LLC",
      "id": "indicator--d7e321ae-b28d-46ea-bbdd-986ba25c7443",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '212.42.54.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T20:05:11.000Z",
      "valid_until": "2026-05-21T20:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-19T20:02:29.170Z",
      "x_nadsec_last_seen": "2026-04-19T20:04:35.284Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48199"
      ],
      "x_nadsec_orgs": [
        "Tehno-Pro LLC"
      ]
    },
    {
      "created": "2026-04-19T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=KR; asn=4766; asn_org=Korea Telecom",
      "id": "indicator--e8c5e57b-9b69-4b50-be61-ecdf17c45007",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '222.106.63.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T20:05:11.000Z",
      "valid_until": "2026-05-21T20:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T19:35:08.503Z",
      "x_nadsec_last_seen": "2026-04-19T19:35:08.503Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "4766"
      ],
      "x_nadsec_orgs": [
        "Korea Telecom"
      ]
    },
    {
      "created": "2026-04-19T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=56041; asn_org=China Mobile communications corporation",
      "id": "indicator--50798fe0-b91b-4b98-8348-3da7f1b20ba8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '223.94.45.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T20:05:11.000Z",
      "valid_until": "2026-05-21T20:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T19:47:01.200Z",
      "x_nadsec_last_seen": "2026-04-19T19:47:01.200Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56041"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-04-19T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=httpd; ports=81; cc=US; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--f465b2cd-8f22-46f2-869a-ff125a4cc6c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '77.83.240.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T20:05:11.000Z",
      "valid_until": "2026-05-21T20:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-19T19:09:14.038Z",
      "x_nadsec_last_seen": "2026-04-19T19:16:10.763Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-04-19T21:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--e4518aa0-297d-4351-99b7-683bdc41eaa8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T21:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '110.90.192.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T21:05:11.000Z",
      "valid_until": "2026-05-21T21:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-04-19T20:24:45.343Z",
      "x_nadsec_last_seen": "2026-04-20T07:58:02.383Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-19T21:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2176; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--2f4e3e45-3402-4f5e-8673-a0aea6ab1e02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T21:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '144.255.93.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T21:05:11.000Z",
      "valid_until": "2026-05-21T21:05:09.000Z",
      "x_nadsec_event_count": 2176,
      "x_nadsec_first_seen": "2026-04-19T21:01:40.744Z",
      "x_nadsec_last_seen": "2026-04-19T21:04:44.119Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-19T21:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--1ef6d8c0-acb8-4adc-81aa-10cfd0a911d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T21:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T21:05:11.000Z",
      "valid_until": "2026-05-21T21:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-19T20:57:27.629Z",
      "x_nadsec_last_seen": "2026-04-19T20:57:28.373Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-20T00:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=7738; asn_org=V tal",
      "id": "indicator--b1766174-900e-4104-be2c-87efcda5a92a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T00:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '191.0.123.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T00:05:22.000Z",
      "valid_until": "2026-05-22T00:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-19T23:32:46.477Z",
      "x_nadsec_last_seen": "2026-04-19T23:32:49.610Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "7738"
      ],
      "x_nadsec_orgs": [
        "V tal"
      ]
    },
    {
      "created": "2026-04-20T00:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PR; asn=11367; asn_org=WorldNet Telecommunications, LLC",
      "id": "indicator--d5bea103-43e1-4ca1-9579-f3cfbadf8a2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T00:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.12.182.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T00:05:22.000Z",
      "valid_until": "2026-05-22T00:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-19T23:34:55.696Z",
      "x_nadsec_last_seen": "2026-04-20T23:55:32.714Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PR"
      ],
      "x_nadsec_asns": [
        "11367"
      ],
      "x_nadsec_orgs": [
        "WorldNet Telecommunications, LLC"
      ]
    },
    {
      "created": "2026-04-20T00:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=NL; asn=205759; asn_org=Ghosty Networks LLC; user(top)=r**t",
      "id": "indicator--65338687-38ed-420c-80b3-6d0f7b395503",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T00:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.151.182.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T00:05:22.000Z",
      "valid_until": "2026-05-22T00:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-19T23:28:50.396Z",
      "x_nadsec_last_seen": "2026-04-19T23:28:50.396Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "205759"
      ],
      "x_nadsec_orgs": [
        "Ghosty Networks LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-20T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=mongod; ports=27017; cc=SG; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--fc81e133-4cf8-4141-a5cb-b5664a15df0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.72.147.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T02:05:13.000Z",
      "valid_until": "2026-05-22T02:05:00.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-04-20T02:04:02.642Z",
      "x_nadsec_last_seen": "2026-04-20T02:04:22.536Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-20T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--14a9a352-c072-4417-b159-259aae678e7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.194.250.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T02:05:13.000Z",
      "valid_until": "2026-05-22T02:05:00.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-20T01:39:25.799Z",
      "x_nadsec_last_seen": "2026-04-30T06:48:30.867Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-20T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--2b65943f-8209-4b29-b929-19dc5e350cfa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.237.124.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T02:05:13.000Z",
      "valid_until": "2026-05-22T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T01:31:16.315Z",
      "x_nadsec_last_seen": "2026-04-20T01:31:16.315Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-20T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH",
      "id": "indicator--9de347db-9131-4d73-b6ea-2a8c762e9254",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T02:05:13.000Z",
      "valid_until": "2026-05-22T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T01:43:04.966Z",
      "x_nadsec_last_seen": "2026-04-20T01:43:04.966Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "215778"
      ],
      "x_nadsec_orgs": [
        "Alpha Strike Labs GmbH"
      ]
    },
    {
      "created": "2026-04-20T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=207909; asn_org=Nikolai Anatolievich Andreenkov",
      "id": "indicator--ca7abfd4-47fc-4da5-a6b7-78d08f92993f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.93.161.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T02:05:13.000Z",
      "valid_until": "2026-05-22T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-20T01:55:18.677Z",
      "x_nadsec_last_seen": "2026-04-20T02:01:00.669Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "207909"
      ],
      "x_nadsec_orgs": [
        "Nikolai Anatolievich Andreenkov"
      ]
    },
    {
      "created": "2026-04-20T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=BD; asn=23688; asn_org=Link3 Technologies Ltd.",
      "id": "indicator--10072a9f-055d-4b19-af47-7f68cb51999b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '203.76.98.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T02:05:13.000Z",
      "valid_until": "2026-05-22T02:05:00.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-20T01:14:21.646Z",
      "x_nadsec_last_seen": "2026-04-20T01:38:27.856Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "23688"
      ],
      "x_nadsec_orgs": [
        "Link3 Technologies Ltd."
      ]
    },
    {
      "created": "2026-04-20T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=NL; asn=205759; asn_org=Ghosty Networks LLC; user(top)=r**t",
      "id": "indicator--7730ed9b-60ad-49c5-8759-2f9dd3a75eb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.151.182.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T02:05:13.000Z",
      "valid_until": "2026-05-22T02:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-20T01:39:02.072Z",
      "x_nadsec_last_seen": "2026-04-23T22:15:42.394Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "205759"
      ],
      "x_nadsec_orgs": [
        "Ghosty Networks LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-20T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--ef33c007-4496-4e60-a15c-a0f559fc7902",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T02:05:13.000Z",
      "valid_until": "2026-05-22T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T01:47:46.870Z",
      "x_nadsec_last_seen": "2026-04-20T01:47:46.870Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-04-20T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=mongod; ports=27017; cc=AU; asn=7545; asn_org=TPG Telecom Limited",
      "id": "indicator--1f1481c3-4d92-4dad-b95f-a4071d353bab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.210.60.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T03:05:06.000Z",
      "valid_until": "2026-05-22T03:05:04.000Z",
      "x_nadsec_event_count": 86,
      "x_nadsec_first_seen": "2026-04-20T02:16:32.804Z",
      "x_nadsec_last_seen": "2026-04-22T08:13:07.181Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "7545"
      ],
      "x_nadsec_orgs": [
        "TPG Telecom Limited"
      ]
    },
    {
      "created": "2026-04-20T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--cb805844-03d2-481a-8ffc-7c1e0ba4680e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.224.162.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T03:05:06.000Z",
      "valid_until": "2026-05-22T03:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-20T02:24:19.231Z",
      "x_nadsec_last_seen": "2026-04-20T02:26:24.128Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-20T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--31c12e54-bb6b-4a39-b9de-1278a0170dcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.195.56.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T03:05:06.000Z",
      "valid_until": "2026-05-22T03:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-20T02:19:25.864Z",
      "x_nadsec_last_seen": "2026-04-21T11:43:03.244Z",
      "x_nadsec_ports": [
        "81",
        "445"
      ],
      "x_nadsec_services": [
        "httpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-20T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--8dcdf15c-2831-4c0b-b009-318b5b801953",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T03:05:06.000Z",
      "valid_until": "2026-05-22T03:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-20T02:46:15.163Z",
      "x_nadsec_last_seen": "2026-04-24T14:29:40.562Z",
      "x_nadsec_ports": [
        "445",
        "1883"
      ],
      "x_nadsec_services": [
        "smbd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-20T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--50b798b1-1619-4cec-a221-a0c70a270814",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.240.223.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T03:05:06.000Z",
      "valid_until": "2026-05-22T03:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-20T02:52:51.268Z",
      "x_nadsec_last_seen": "2026-04-25T11:07:57.263Z",
      "x_nadsec_ports": [
        "21",
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-04-20T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=16637; asn_org=MTN Business Solutions",
      "id": "indicator--c2cba590-054c-42d5-9c7d-cd4ff23f6ca5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.8.6.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T03:05:06.000Z",
      "valid_until": "2026-05-22T03:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-20T02:33:33.449Z",
      "x_nadsec_last_seen": "2026-04-20T02:35:41.012Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "16637"
      ],
      "x_nadsec_orgs": [
        "MTN Business Solutions"
      ]
    },
    {
      "created": "2026-04-20T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--20648bee-b5c1-468d-bb19-eb2684bd7a40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T04:05:02.000Z",
      "valid_until": "2026-05-22T04:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-20T03:08:17.033Z",
      "x_nadsec_last_seen": "2026-04-24T00:39:11.948Z",
      "x_nadsec_ports": [
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-20T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mysqld; ports=3306; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--8c9abac8-12e5-4de0-8cbe-d66291d27e5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '115.231.197.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T05:05:10.000Z",
      "valid_until": "2026-05-22T05:05:08.000Z",
      "x_nadsec_event_count": 20,
      "x_nadsec_first_seen": "2026-04-20T04:53:48.215Z",
      "x_nadsec_last_seen": "2026-04-27T12:40:54.850Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-20T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e9a19e95-ef7b-483a-942b-7b373f9229d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T05:05:10.000Z",
      "valid_until": "2026-05-22T05:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T04:16:26.483Z",
      "x_nadsec_last_seen": "2026-04-20T04:16:26.483Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-20T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45557; asn_org=Vietnam Technology and Telecommunication JSC",
      "id": "indicator--1f8723d7-1ab8-4418-8837-5f4c8721ef79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.118.136.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T05:05:10.000Z",
      "valid_until": "2026-05-22T05:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-20T04:19:17.625Z",
      "x_nadsec_last_seen": "2026-04-20T04:25:43.007Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45557"
      ],
      "x_nadsec_orgs": [
        "Vietnam Technology and Telecommunication JSC"
      ]
    },
    {
      "created": "2026-04-20T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**",
      "id": "indicator--9f9c0022-fe80-4b6a-9953-db9aea065334",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '60.173.100.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T05:05:10.000Z",
      "valid_until": "2026-05-22T05:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T04:59:19.892Z",
      "x_nadsec_last_seen": "2026-04-20T04:59:19.892Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-20T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--4e02d4b2-151c-4812-bc82-831d753db06a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.26.164.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T05:05:10.000Z",
      "valid_until": "2026-05-22T05:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-20T04:11:05.734Z",
      "x_nadsec_last_seen": "2026-04-20T04:13:11.025Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-04-20T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--d878fe13-0534-49d1-ae8d-3285343a4941",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '128.1.44.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T06:05:03.000Z",
      "valid_until": "2026-05-22T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T05:55:45.187Z",
      "x_nadsec_last_seen": "2026-04-20T05:55:45.187Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-20T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=150228; asn_org=PT Argiz Mitra Technology",
      "id": "indicator--fc8ed197-e067-46aa-adda-b56db42b1632",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '202.47.66.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T06:05:03.000Z",
      "valid_until": "2026-05-22T06:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-20T05:11:44.940Z",
      "x_nadsec_last_seen": "2026-04-20T05:17:55.472Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "150228"
      ],
      "x_nadsec_orgs": [
        "PT Argiz Mitra Technology"
      ]
    },
    {
      "created": "2026-04-20T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--1fd509e0-23ec-4248-99ce-6563e84a8b7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T06:05:03.000Z",
      "valid_until": "2026-05-22T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T06:03:21.360Z",
      "x_nadsec_last_seen": "2026-04-20T06:03:21.360Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-04-20T07:05:42.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=pptpd; ports=1723; cc=CH; asn=402253; asn_org=SKN Subnet & Telecom Ltd",
      "id": "indicator--7f353750-b2f4-40a7-b8b2-4aff02883b28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T07:05:42.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.251.181.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T07:05:42.000Z",
      "valid_until": "2026-05-22T07:05:15.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-20T06:26:55.321Z",
      "x_nadsec_last_seen": "2026-04-20T06:26:55.656Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "402253"
      ],
      "x_nadsec_orgs": [
        "SKN Subnet & Telecom Ltd"
      ]
    },
    {
      "created": "2026-04-20T07:05:42.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MY; asn=9930; asn_org=TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al",
      "id": "indicator--789b6944-403e-40ee-90b4-e20d83ebbc68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T07:05:42.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '202.187.236.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T07:05:42.000Z",
      "valid_until": "2026-05-22T07:05:15.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-20T06:48:24.854Z",
      "x_nadsec_last_seen": "2026-04-20T18:39:01.733Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "9930"
      ],
      "x_nadsec_orgs": [
        "TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al"
      ]
    },
    {
      "created": "2026-04-20T07:05:42.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--919496eb-6a93-4e01-803f-f38da11799c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T07:05:42.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T07:05:42.000Z",
      "valid_until": "2026-05-22T07:05:15.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T06:39:41.960Z",
      "x_nadsec_last_seen": "2026-04-20T06:39:41.960Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-20T07:05:42.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--9145faaa-b588-4734-bee6-86da73ba520f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T07:05:42.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.249.192.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T07:05:42.000Z",
      "valid_until": "2026-05-22T07:05:15.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-20T06:05:10.340Z",
      "x_nadsec_last_seen": "2026-04-20T06:05:20.511Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-20T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--84fd24dc-b323-40ce-8bf7-1ba96e098c36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.163.13.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T08:05:02.000Z",
      "valid_until": "2026-05-22T08:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-20T07:47:03.291Z",
      "x_nadsec_last_seen": "2026-04-20T07:47:03.886Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-20T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=11172; asn_org=Alestra, S. de R.L. de C.V.",
      "id": "indicator--708d24ce-b8dd-4dcd-b2ea-4bdb59acc96b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '200.94.131.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T08:05:02.000Z",
      "valid_until": "2026-05-22T08:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-20T08:01:47.233Z",
      "x_nadsec_last_seen": "2026-04-27T17:40:10.490Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "11172"
      ],
      "x_nadsec_orgs": [
        "Alestra, S. de R.L. de C.V."
      ]
    },
    {
      "created": "2026-04-20T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=TH; asn=133481; asn_org=AIS Fibre",
      "id": "indicator--3b240b01-0b63-4c0a-861b-748ede5cc4f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '58.136.228.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T08:05:02.000Z",
      "valid_until": "2026-05-22T08:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-20T07:58:35.185Z",
      "x_nadsec_last_seen": "2026-04-20T07:58:35.699Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "133481"
      ],
      "x_nadsec_orgs": [
        "AIS Fibre"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-20T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--81d5fa00-4f1a-4173-9eee-b9787eef77d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T08:05:02.000Z",
      "valid_until": "2026-05-22T08:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-20T07:33:16.742Z",
      "x_nadsec_last_seen": "2026-04-23T03:31:39.620Z",
      "x_nadsec_ports": [
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-20T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--1ca63473-bdb6-459b-9cb8-440f8600bfd8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T08:05:02.000Z",
      "valid_until": "2026-05-22T08:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T08:03:27.841Z",
      "x_nadsec_last_seen": "2026-04-20T08:03:27.841Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-20T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--d5b4fb65-dd79-4fde-98fd-88a465196940",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T08:05:02.000Z",
      "valid_until": "2026-05-22T08:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T07:57:02.356Z",
      "x_nadsec_last_seen": "2026-04-20T07:57:02.356Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-20T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--f24ff9a9-0ccd-4db9-9d31-c7a6ef5827fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.91.77.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T09:05:02.000Z",
      "valid_until": "2026-05-22T09:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-20T08:29:10.554Z",
      "x_nadsec_last_seen": "2026-04-20T08:31:17.877Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-04-20T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=58369; asn_org=PT. Fiber Networks Indonesia",
      "id": "indicator--c78b042d-738b-41eb-a780-8afe423d60b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.144.126.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T09:05:02.000Z",
      "valid_until": "2026-05-22T09:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-20T08:24:33.577Z",
      "x_nadsec_last_seen": "2026-04-20T08:26:37.903Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "58369"
      ],
      "x_nadsec_orgs": [
        "PT. Fiber Networks Indonesia"
      ]
    },
    {
      "created": "2026-04-20T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--bd96bf7d-f247-426b-b68b-7e89b456ecdb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '119.123.173.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T09:05:02.000Z",
      "valid_until": "2026-05-22T09:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-20T08:26:01.333Z",
      "x_nadsec_last_seen": "2026-04-20T08:28:06.531Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-20T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--24b418fc-ffca-4065-9c5d-0ddf02b232de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.176.231.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T09:05:02.000Z",
      "valid_until": "2026-05-22T09:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-20T08:15:09.375Z",
      "x_nadsec_last_seen": "2026-04-20T08:21:26.881Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-20T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--338f6b54-8bde-44c7-b2c5-f64a46af405b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.172.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T09:05:02.000Z",
      "valid_until": "2026-05-22T09:05:00.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-20T08:46:57.940Z",
      "x_nadsec_last_seen": "2026-04-20T08:47:42.950Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-20T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=NL; asn=205759; asn_org=Ghosty Networks LLC; user(top)=r**t",
      "id": "indicator--0d24042a-cea3-4a38-97eb-2d93caeaa27f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.151.182.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T09:05:02.000Z",
      "valid_until": "2026-05-22T09:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T08:05:47.473Z",
      "x_nadsec_last_seen": "2026-04-20T08:05:47.473Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "205759"
      ],
      "x_nadsec_orgs": [
        "Ghosty Networks LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-20T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--9defc4ad-c2fe-4bf4-9b48-879737233edf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T09:05:02.000Z",
      "valid_until": "2026-05-22T09:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T08:55:17.528Z",
      "x_nadsec_last_seen": "2026-04-20T08:55:17.528Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-20T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--f557a6e0-b479-457a-915d-d26ce7fe2962",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T09:05:02.000Z",
      "valid_until": "2026-05-22T09:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T08:37:15.944Z",
      "x_nadsec_last_seen": "2026-04-20T08:37:15.944Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-20T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--d12455f3-4034-45a7-8754-218e065bbe12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T09:05:02.000Z",
      "valid_until": "2026-05-22T09:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-20T08:58:17.556Z",
      "x_nadsec_last_seen": "2026-04-25T12:35:23.283Z",
      "x_nadsec_ports": [
        "42",
        "3306",
        "35463"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-20T10:06:58.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=SY; asn=29256; asn_org=Syrian Telecommunication Private Closed Joint Stock Company",
      "id": "indicator--234fa1c5-aacc-4bba-90f3-5ba6c38a65d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T10:06:58.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.253.96.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T10:06:58.000Z",
      "valid_until": "2026-05-22T10:05:09.000Z",
      "x_nadsec_event_count": 45,
      "x_nadsec_first_seen": "2026-04-20T09:40:56.233Z",
      "x_nadsec_last_seen": "2026-04-20T09:44:24.461Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SY"
      ],
      "x_nadsec_asns": [
        "29256"
      ],
      "x_nadsec_orgs": [
        "Syrian Telecommunication Private Closed Joint Stock Company"
      ]
    },
    {
      "created": "2026-04-20T10:06:58.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--aecf776a-915f-4728-ad57-9ccf8fe75aed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T10:06:58.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.106.32.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T10:06:58.000Z",
      "valid_until": "2026-05-22T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-20T09:10:47.969Z",
      "x_nadsec_last_seen": "2026-04-20T09:10:58.143Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-20T10:06:58.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=46; services=smbd; ports=445; cc=EG; asn=36992; asn_org=Etisalat Misr",
      "id": "indicator--d53f5542-4d01-47da-a026-982d18147523",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T10:06:58.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '62.114.123.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T10:06:58.000Z",
      "valid_until": "2026-05-22T10:05:09.000Z",
      "x_nadsec_event_count": 3108,
      "x_nadsec_first_seen": "2026-04-20T09:36:51.364Z",
      "x_nadsec_last_seen": "2026-04-20T13:21:13.172Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "36992"
      ],
      "x_nadsec_orgs": [
        "Etisalat Misr"
      ]
    },
    {
      "created": "2026-04-20T10:06:58.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=NL; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--7e9e4bd7-0420-4bda-8f0b-b69032e77a42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T10:06:58.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.102.49.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T10:06:58.000Z",
      "valid_until": "2026-05-22T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-20T09:32:55.782Z",
      "x_nadsec_last_seen": "2026-04-30T12:20:14.062Z",
      "x_nadsec_ports": [
        "81",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-04-20T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--ca78b679-5c85-4d01-bcae-7513e391d83c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.218.241.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T11:05:10.000Z",
      "valid_until": "2026-05-22T11:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T10:29:36.085Z",
      "x_nadsec_last_seen": "2026-04-20T10:29:36.085Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-20T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mongod; ports=27017; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--1d5fb196-7f7e-4456-bce6-963147b1bdc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.150.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T11:05:10.000Z",
      "valid_until": "2026-05-22T11:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-20T10:27:12.465Z",
      "x_nadsec_last_seen": "2026-04-20T16:45:20.900Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-20T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=11776; asn_org=Breezeline",
      "id": "indicator--0cfaf03a-d2c0-49f7-a3fc-b44bb7cfc777",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.188.140.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T11:05:10.000Z",
      "valid_until": "2026-05-22T11:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-20T10:11:15.841Z",
      "x_nadsec_last_seen": "2026-04-20T10:11:15.995Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "11776"
      ],
      "x_nadsec_orgs": [
        "Breezeline"
      ]
    },
    {
      "created": "2026-04-20T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--27de1863-57d2-4f58-b9a5-d711afe0c9fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.221.72.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T11:05:10.000Z",
      "valid_until": "2026-05-22T11:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-20T10:17:49.731Z",
      "x_nadsec_last_seen": "2026-04-20T10:17:50.083Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-20T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=25159; asn_org=PJSC MegaFon",
      "id": "indicator--9acf96dd-3d90-48d0-b026-c847588b669c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '31.173.84.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T11:05:10.000Z",
      "valid_until": "2026-05-22T11:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-20T10:23:22.492Z",
      "x_nadsec_last_seen": "2026-04-20T10:25:27.584Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25159"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-04-20T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=17439; asn_org=NTT COMMUNICATIONS INDIA NETWORK SERVICES PRIVATE LIMITED; user(top)=**",
      "id": "indicator--ec58d380-8fce-42dd-b437-92e34ccd1015",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '180.179.236.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T12:05:11.000Z",
      "valid_until": "2026-05-22T12:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-20T11:21:25.597Z",
      "x_nadsec_last_seen": "2026-04-28T16:36:11.698Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17439"
      ],
      "x_nadsec_orgs": [
        "NTT COMMUNICATIONS INDIA NETWORK SERVICES PRIVATE LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-20T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--8a4cde1f-c682-45a3-8259-c9d9ed5ca19f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '2.63.203.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T12:05:11.000Z",
      "valid_until": "2026-05-22T12:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-20T11:34:15.866Z",
      "x_nadsec_last_seen": "2026-04-20T11:37:50.536Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-20T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=NL; asn=205759; asn_org=Ghosty Networks LLC; user(top)=r**t",
      "id": "indicator--cb14039e-a6db-4744-a68c-4c03bc9115b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.151.182.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T12:05:11.000Z",
      "valid_until": "2026-05-22T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T11:11:20.315Z",
      "x_nadsec_last_seen": "2026-04-20T11:11:20.315Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "205759"
      ],
      "x_nadsec_orgs": [
        "Ghosty Networks LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-20T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--c980543b-0440-4acb-9aef-a6769ea70978",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.188.217.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T13:05:11.000Z",
      "valid_until": "2026-05-22T13:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-20T12:43:01.574Z",
      "x_nadsec_last_seen": "2026-04-20T12:45:05.632Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-20T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--027a9bfc-3c71-4107-afef-97a4630346a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.69.128.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T13:05:11.000Z",
      "valid_until": "2026-05-22T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-20T12:05:31.362Z",
      "x_nadsec_last_seen": "2026-04-20T12:07:36.011Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-04-20T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=34; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--80826dae-0e7f-48fc-b69f-47d73ab0c372",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '137.184.145.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T13:05:11.000Z",
      "valid_until": "2026-05-22T13:05:09.000Z",
      "x_nadsec_event_count": 34,
      "x_nadsec_first_seen": "2026-04-20T12:47:41.634Z",
      "x_nadsec_last_seen": "2026-04-20T12:48:39.979Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-20T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--2a4637ee-798a-492d-8169-49e13a908045",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '159.223.104.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T13:05:11.000Z",
      "valid_until": "2026-05-22T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T12:44:48.026Z",
      "x_nadsec_last_seen": "2026-04-20T12:44:48.026Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-20T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=httpd; ports=81; cc=SC; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--4b559977-fe68-4bbd-9181-f0c09f735b33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T13:05:11.000Z",
      "valid_until": "2026-05-22T13:05:09.000Z",
      "x_nadsec_event_count": 36,
      "x_nadsec_first_seen": "2026-04-20T12:15:54.930Z",
      "x_nadsec_last_seen": "2026-04-22T15:40:06.745Z",
      "x_nadsec_ports": [
        "81",
        "135",
        "1433",
        "1723",
        "1883",
        "27017",
        "21",
        "3306",
        "445"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "pptpd",
        "ftpd",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-04-20T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MX; asn=13999; asn_org=Mega Cable, S.A. de C.V.; user(top)=**",
      "id": "indicator--b18579c3-eb08-42db-bae2-55d5bdec871a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '201.132.118.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T13:05:11.000Z",
      "valid_until": "2026-05-22T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T12:25:15.473Z",
      "x_nadsec_last_seen": "2026-04-20T12:25:15.473Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "13999"
      ],
      "x_nadsec_orgs": [
        "Mega Cable, S.A. de C.V."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-20T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=34; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--3f9e7203-7bb5-405d-a157-1accee0c1a71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.227.18.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T13:05:11.000Z",
      "valid_until": "2026-05-22T13:05:09.000Z",
      "x_nadsec_event_count": 34,
      "x_nadsec_first_seen": "2026-04-20T13:02:55.252Z",
      "x_nadsec_last_seen": "2026-04-20T13:03:53.550Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-20T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--3c71ee04-7497-47c9-8480-a3e6c59298fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T13:05:11.000Z",
      "valid_until": "2026-05-22T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T12:47:30.067Z",
      "x_nadsec_last_seen": "2026-04-20T12:47:30.067Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-20T14:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=31566; asn_org=SkyNetwork Ltd.",
      "id": "indicator--35a61dda-6c29-4c85-8651-940f3b6c4fe5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T14:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.59.33.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T14:05:36.000Z",
      "valid_until": "2026-05-22T14:05:13.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T13:24:32.788Z",
      "x_nadsec_last_seen": "2026-04-20T13:24:32.788Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31566"
      ],
      "x_nadsec_orgs": [
        "SkyNetwork Ltd."
      ]
    },
    {
      "created": "2026-04-20T14:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--d80d57ac-f837-4057-a8ab-9223054f3151",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T14:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T14:05:36.000Z",
      "valid_until": "2026-05-22T14:05:13.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-09T07:20:09.476Z",
      "x_nadsec_last_seen": "2026-04-28T09:32:28.079Z",
      "x_nadsec_ports": [
        "445",
        "1723",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "mongod",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-20T14:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=FR; asn=51167; asn_org=Contabo GmbH",
      "id": "indicator--5f32278d-5ca3-428a-a633-00e54b75e96c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T14:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '84.247.175.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T14:05:36.000Z",
      "valid_until": "2026-05-22T14:05:13.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-20T13:51:14.043Z",
      "x_nadsec_last_seen": "2026-04-20T13:51:15.308Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "51167"
      ],
      "x_nadsec_orgs": [
        "Contabo GmbH"
      ]
    },
    {
      "created": "2026-04-20T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--a1aeb8b1-7385-487f-9dc2-cc9b060fead7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.26.39.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T15:05:13.000Z",
      "valid_until": "2026-05-22T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T14:29:44.447Z",
      "x_nadsec_last_seen": "2026-04-20T14:29:44.447Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-20T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--811359b6-ae27-4843-9545-88d9a92dcb29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T15:05:13.000Z",
      "valid_until": "2026-05-22T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-20T14:23:37.578Z",
      "x_nadsec_last_seen": "2026-04-27T14:52:23.662Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-20T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--6882a353-6d17-452a-a267-a099504be7b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.169.85.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T15:05:13.000Z",
      "valid_until": "2026-05-22T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-20T14:40:14.908Z",
      "x_nadsec_last_seen": "2026-04-20T14:40:25.198Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-20T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--06146911-f05a-4a6e-99c3-f1dd98759d0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T15:05:13.000Z",
      "valid_until": "2026-05-22T15:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-19T07:35:54.625Z",
      "x_nadsec_last_seen": "2026-04-29T07:33:25.775Z",
      "x_nadsec_ports": [
        "21",
        "135"
      ],
      "x_nadsec_services": [
        "ftpd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-20T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--409bcfde-b771-4a2c-abdb-4c37760bd3b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '115.215.65.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T16:05:10.000Z",
      "valid_until": "2026-05-22T16:05:08.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-04-20T15:39:11.960Z",
      "x_nadsec_last_seen": "2026-04-20T15:39:28.861Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "!******x"
      ]
    },
    {
      "created": "2026-04-20T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=16735; asn_org=ALGAR TELECOM SA",
      "id": "indicator--babd0fcc-ca83-42ee-b022-0396684e2446",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.112.4.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T16:05:10.000Z",
      "valid_until": "2026-05-22T16:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-20T15:23:31.702Z",
      "x_nadsec_last_seen": "2026-04-20T15:23:32.207Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "16735"
      ],
      "x_nadsec_orgs": [
        "ALGAR TELECOM SA"
      ]
    },
    {
      "created": "2026-04-20T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--69e26472-ea4b-4bf6-a6ab-8cf861a441f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T16:05:10.000Z",
      "valid_until": "2026-05-22T16:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T15:46:36.145Z",
      "x_nadsec_last_seen": "2026-04-20T15:46:36.145Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-20T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--133bf4d5-b2f5-4f7c-913d-0dd8fcbc918d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.101.166.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T16:05:10.000Z",
      "valid_until": "2026-05-22T16:05:08.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-04-20T15:14:39.902Z",
      "x_nadsec_last_seen": "2026-04-20T15:18:38.121Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-20T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--e3634c5a-ee25-41f8-bab5-55e59f27989f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T16:05:10.000Z",
      "valid_until": "2026-05-22T16:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T15:12:16.911Z",
      "x_nadsec_last_seen": "2026-04-20T15:12:16.911Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-20T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12418; asn_org=Quantum CJSC",
      "id": "indicator--9f805a9e-dcd3-47be-817a-e1b7b0ed4e15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '88.86.82.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T16:05:10.000Z",
      "valid_until": "2026-05-22T16:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-20T15:05:10.676Z",
      "x_nadsec_last_seen": "2026-04-20T15:07:15.607Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12418"
      ],
      "x_nadsec_orgs": [
        "Quantum CJSC"
      ]
    },
    {
      "created": "2026-04-20T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--7de7bad5-5671-4bed-adf1-b93c724321e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.242.32.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T17:05:10.000Z",
      "valid_until": "2026-05-22T17:05:09.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-04-20T16:13:52.857Z",
      "x_nadsec_last_seen": "2026-04-20T16:16:29.120Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-04-20T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=266428; asn_org=R L A World Net LTDA",
      "id": "indicator--1b2c2ce0-bbdb-4ad5-8823-f083e9925940",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '170.81.153.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T17:05:10.000Z",
      "valid_until": "2026-05-22T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-20T16:20:11.833Z",
      "x_nadsec_last_seen": "2026-04-20T16:22:18.670Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "266428"
      ],
      "x_nadsec_orgs": [
        "R L A World Net LTDA"
      ]
    },
    {
      "created": "2026-04-20T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=270678; asn_org=W.B.G INFORMATICA E TELECOMUNICACOES EIRELI",
      "id": "indicator--620f70f8-bdff-417a-af11-5d32a087d35f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '177.221.189.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T17:05:10.000Z",
      "valid_until": "2026-05-22T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-20T17:02:55.698Z",
      "x_nadsec_last_seen": "2026-04-20T17:05:02.013Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "270678"
      ],
      "x_nadsec_orgs": [
        "W.B.G INFORMATICA E TELECOMUNICACOES EIRELI"
      ]
    },
    {
      "created": "2026-04-20T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d76e352b-920d-4811-abf1-9efbc5eb975e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T17:05:10.000Z",
      "valid_until": "2026-05-22T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T17:02:11.575Z",
      "x_nadsec_last_seen": "2026-04-20T17:02:11.575Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-20T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--bda41b22-5f12-4b74-96a7-48e75ececa78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T17:05:10.000Z",
      "valid_until": "2026-05-22T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T17:02:12.278Z",
      "x_nadsec_last_seen": "2026-04-20T17:02:12.278Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-20T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6423fdcd-4169-4274-a04e-7f9bd57336bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T17:05:10.000Z",
      "valid_until": "2026-05-22T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T16:23:15.240Z",
      "x_nadsec_last_seen": "2026-04-20T16:23:15.240Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-20T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--ce701a43-0ca5-4853-a639-3d59d98447da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T17:05:10.000Z",
      "valid_until": "2026-05-22T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T16:49:16.114Z",
      "x_nadsec_last_seen": "2026-04-20T16:49:16.114Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-20T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--90b14764-b172-4246-87ab-91c0eeafaaa9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.245.143.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T17:05:10.000Z",
      "valid_until": "2026-05-22T17:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-20T16:59:15.441Z",
      "x_nadsec_last_seen": "2026-04-20T16:59:39.565Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-20T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--9fe40dc0-1eef-40ba-b4cf-e7737cadc621",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T17:05:10.000Z",
      "valid_until": "2026-05-22T17:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-20T16:31:33.694Z",
      "x_nadsec_last_seen": "2026-04-27T15:49:33.766Z",
      "x_nadsec_ports": [
        "1433",
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-20T18:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--235e044d-147f-495b-941a-31aaf73bccb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T18:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.168.127.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T18:05:14.000Z",
      "valid_until": "2026-05-22T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T17:38:23.526Z",
      "x_nadsec_last_seen": "2026-04-20T17:38:23.526Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-20T18:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4fc32141-e73f-4da9-b45b-ce933709b736",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T18:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.221.68.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T18:05:14.000Z",
      "valid_until": "2026-05-22T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-20T17:17:24.162Z",
      "x_nadsec_last_seen": "2026-04-20T17:17:34.337Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-20T18:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--542c2a9d-1c9e-4e66-8af7-6f0b7727668a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T18:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T18:05:14.000Z",
      "valid_until": "2026-05-22T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T17:13:21.286Z",
      "x_nadsec_last_seen": "2026-04-20T17:13:21.286Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-20T18:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ZA; asn=327693; asn_org=ECHO-SP",
      "id": "indicator--020acf2f-55a1-41b8-91b0-5790b0ca3be3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T18:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.76.230.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T18:05:14.000Z",
      "valid_until": "2026-05-22T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-20T17:53:00.203Z",
      "x_nadsec_last_seen": "2026-04-20T17:54:07.330Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "327693"
      ],
      "x_nadsec_orgs": [
        "ECHO-SP"
      ]
    },
    {
      "created": "2026-04-20T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--93131b20-04b2-4956-bd1b-b0284c7c43c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.163.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T19:05:10.000Z",
      "valid_until": "2026-05-22T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T18:51:09.071Z",
      "x_nadsec_last_seen": "2026-04-20T18:51:09.071Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-20T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=BR; asn=4230; asn_org=CLARO S.A.",
      "id": "indicator--68ca28e3-7116-4b93-8abc-fac7862823a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '200.242.151.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T19:05:10.000Z",
      "valid_until": "2026-05-22T19:05:09.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-04-20T18:19:20.333Z",
      "x_nadsec_last_seen": "2026-04-20T18:22:04.097Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "4230"
      ],
      "x_nadsec_orgs": [
        "CLARO S.A."
      ]
    },
    {
      "created": "2026-04-20T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=BG; asn=213438; asn_org=ColocaTel Inc.",
      "id": "indicator--3ff62667-eecd-48f8-a3e4-7c19bf4f9a1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.11.167.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T19:05:10.000Z",
      "valid_until": "2026-05-22T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T19:04:24.176Z",
      "x_nadsec_last_seen": "2026-04-20T19:04:24.176Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "213438"
      ],
      "x_nadsec_orgs": [
        "ColocaTel Inc."
      ]
    },
    {
      "created": "2026-04-20T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=16735; asn_org=ALGAR TELECOM SA",
      "id": "indicator--9c8a88d3-9852-4fba-addf-6dbc74d5d858",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '187.32.154.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T20:05:12.000Z",
      "valid_until": "2026-05-22T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-20T19:49:13.543Z",
      "x_nadsec_last_seen": "2026-04-20T19:51:20.616Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "16735"
      ],
      "x_nadsec_orgs": [
        "ALGAR TELECOM SA"
      ]
    },
    {
      "created": "2026-04-20T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--3233008b-e615-49f9-a913-a851c8e045d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.188.243.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T20:05:12.000Z",
      "valid_until": "2026-05-22T20:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-20T19:55:25.600Z",
      "x_nadsec_last_seen": "2026-04-25T10:51:57.865Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-04-20T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b35f1435-424a-4782-8cca-fe0560996fae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T20:05:12.000Z",
      "valid_until": "2026-05-22T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-20T19:09:02.506Z",
      "x_nadsec_last_seen": "2026-04-26T01:28:16.163Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-20T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--80418dc3-cc56-4583-a4f8-e401ecaa1a3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T20:05:12.000Z",
      "valid_until": "2026-05-22T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-20T19:11:40.034Z",
      "x_nadsec_last_seen": "2026-04-20T19:11:50.193Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-20T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--32ebc25e-b6f8-4e33-acba-df39870d1915",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '218.65.84.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T20:05:12.000Z",
      "valid_until": "2026-05-22T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T19:58:31.304Z",
      "x_nadsec_last_seen": "2026-04-20T19:58:31.304Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-20T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d98ea06c-8987-4056-a800-e45b0cac448b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T20:05:12.000Z",
      "valid_until": "2026-05-22T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T19:33:57.634Z",
      "x_nadsec_last_seen": "2026-04-20T19:33:57.634Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-20T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--e7a831b3-b849-4ced-b74c-1b74c4f8afec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T20:05:12.000Z",
      "valid_until": "2026-05-22T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T19:33:57.957Z",
      "x_nadsec_last_seen": "2026-04-20T19:33:57.957Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-20T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--4ee30982-c395-4e00-9d67-935680ec95c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T20:05:12.000Z",
      "valid_until": "2026-05-22T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-20T19:47:05.444Z",
      "x_nadsec_last_seen": "2026-04-20T19:47:05.917Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-20T22:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8492; asn_org=OBIT Ltd.",
      "id": "indicator--f121c5c5-0581-4743-a9b7-f3c594aba26e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T22:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '149.126.21.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T22:05:12.000Z",
      "valid_until": "2026-05-22T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-20T21:53:28.197Z",
      "x_nadsec_last_seen": "2026-04-20T21:55:34.659Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8492"
      ],
      "x_nadsec_orgs": [
        "OBIT Ltd."
      ]
    },
    {
      "created": "2026-04-20T22:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--44560b76-da8b-426e-850a-a9e34d875f40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T22:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.163.15.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T22:05:12.000Z",
      "valid_until": "2026-05-22T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-20T21:35:04.734Z",
      "x_nadsec_last_seen": "2026-04-20T21:35:15.028Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-20T22:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--add26371-178d-4f79-9275-617082baaa37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T22:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T22:05:12.000Z",
      "valid_until": "2026-05-22T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T21:53:53.127Z",
      "x_nadsec_last_seen": "2026-04-20T21:53:53.127Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-20T22:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--22843072-f513-4f20-b76e-c1160c4addd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T22:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T22:05:12.000Z",
      "valid_until": "2026-05-22T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-13T03:26:07.900Z",
      "x_nadsec_last_seen": "2026-04-20T21:16:42.439Z",
      "x_nadsec_ports": [
        "135",
        "1723"
      ],
      "x_nadsec_services": [
        "epmapper",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-20T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mssqld; ports=1433; cc=BR; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--028cda3d-e382-406c-b87d-9e8ee0e494a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.199.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T23:05:13.000Z",
      "valid_until": "2026-05-22T23:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-20T22:33:46.087Z",
      "x_nadsec_last_seen": "2026-04-20T22:34:44.573Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-20T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--61f35dba-a4e0-4acb-a222-f8cf645a4a36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.206.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T23:05:13.000Z",
      "valid_until": "2026-05-22T23:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-20T22:38:03.712Z",
      "x_nadsec_last_seen": "2026-04-20T22:38:49.562Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-20T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CL; asn=16629; asn_org=CTC. CORP S.A. TELEFONICA EMPRESAS",
      "id": "indicator--197d5400-1d90-435d-b558-a7341c989ea3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '181.212.92.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T23:05:13.000Z",
      "valid_until": "2026-05-22T23:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-20T23:02:08.023Z",
      "x_nadsec_last_seen": "2026-04-20T23:09:26.444Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "16629"
      ],
      "x_nadsec_orgs": [
        "CTC. CORP S.A. TELEFONICA EMPRESAS"
      ]
    },
    {
      "created": "2026-04-20T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--91a0d99d-eab0-4a77-aab4-f9ad96d61fe5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T23:05:13.000Z",
      "valid_until": "2026-05-22T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T22:22:08.254Z",
      "x_nadsec_last_seen": "2026-04-20T22:22:08.254Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-20T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--5b9afecc-705e-4697-ba51-9c1241f49706",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.46.226.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T23:05:13.000Z",
      "valid_until": "2026-05-22T23:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-20T22:29:11.049Z",
      "x_nadsec_last_seen": "2026-04-20T22:29:21.398Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-21T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--0e6312df-ba5b-4da9-b892-e02aacac50db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '144.172.92.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T00:05:13.000Z",
      "valid_until": "2026-05-23T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-20T23:11:42.170Z",
      "x_nadsec_last_seen": "2026-04-20T23:11:42.175Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-04-21T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--15248f69-5316-4eca-bd01-c1a8cee4c647",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.157.154.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T00:05:13.000Z",
      "valid_until": "2026-05-23T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T00:00:06.761Z",
      "x_nadsec_last_seen": "2026-04-21T00:00:06.888Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-04-21T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f69af1a4-3a9f-4c7c-b987-cbc4e894f58a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.163.14.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T00:05:13.000Z",
      "valid_until": "2026-05-23T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T23:32:51.926Z",
      "x_nadsec_last_seen": "2026-04-20T23:32:51.926Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-21T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--938da464-7043-4aef-afe9-a87f4b4e4b96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.64.104.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T00:05:13.000Z",
      "valid_until": "2026-05-23T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-20T23:25:05.990Z",
      "x_nadsec_last_seen": "2026-04-20T23:25:16.317Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-21T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--efe42883-df1b-4430-b480-702b3f7ecdf4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.124.80.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T00:05:13.000Z",
      "valid_until": "2026-05-23T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T23:52:56.746Z",
      "x_nadsec_last_seen": "2026-04-20T23:52:56.746Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-21T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--c12e3b39-def7-44cf-80f9-0e537ed1e403",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T00:05:13.000Z",
      "valid_until": "2026-05-23T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T23:18:42.412Z",
      "x_nadsec_last_seen": "2026-04-20T23:18:42.412Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-21T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--2cf60998-c673-4a0f-bbe5-041eb2222718",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T00:05:13.000Z",
      "valid_until": "2026-05-23T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-20T23:19:06.127Z",
      "x_nadsec_last_seen": "2026-04-20T23:19:16.337Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-21T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--1abebedd-e5d6-4400-8304-7ade3b01fd90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T00:05:13.000Z",
      "valid_until": "2026-05-23T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-20T23:18:42.153Z",
      "x_nadsec_last_seen": "2026-04-20T23:18:42.153Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-21T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--0808f20d-decf-4d6e-a88a-3c8e74fb7a98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.193.39.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T01:05:03.000Z",
      "valid_until": "2026-05-23T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T00:23:36.536Z",
      "x_nadsec_last_seen": "2026-04-21T00:23:36.536Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-21T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--a94b7e1a-f4f6-4deb-a14d-6edd7bac61fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '125.73.216.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T01:05:03.000Z",
      "valid_until": "2026-05-23T01:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-21T00:09:27.948Z",
      "x_nadsec_last_seen": "2026-04-21T00:16:35.960Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-21T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MN; asn=17882; asn_org=UNIVISION LLC",
      "id": "indicator--12ed9331-2284-43a1-a9ac-c6f3b0a778b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '192.82.64.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T01:05:03.000Z",
      "valid_until": "2026-05-23T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-21T00:46:16.973Z",
      "x_nadsec_last_seen": "2026-04-21T00:53:37.317Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "17882"
      ],
      "x_nadsec_orgs": [
        "UNIVISION LLC"
      ]
    },
    {
      "created": "2026-04-21T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--fb335778-1449-45d0-a83b-7f2fcdf4b5ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T01:05:03.000Z",
      "valid_until": "2026-05-23T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T01:04:23.304Z",
      "x_nadsec_last_seen": "2026-04-21T01:04:23.304Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-21T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c423d8de-a499-45d9-aa1a-4d50d7467839",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.80.72.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T01:05:03.000Z",
      "valid_until": "2026-05-23T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T00:56:41.651Z",
      "x_nadsec_last_seen": "2026-04-21T00:56:41.651Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-21T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--60af568f-e51c-4723-b3e2-4cccb5e6c624",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '39.129.148.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T01:05:03.000Z",
      "valid_until": "2026-05-23T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-21T00:07:54.948Z",
      "x_nadsec_last_seen": "2026-04-21T00:10:00.123Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-04-21T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EC; asn=269853; asn_org=CBVISION S.A.",
      "id": "indicator--67de1e0d-0f7d-44c8-8363-b83d5a0d3982",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.189.57.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T01:05:03.000Z",
      "valid_until": "2026-05-23T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-21T00:18:02.908Z",
      "x_nadsec_last_seen": "2026-04-21T00:20:08.691Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "269853"
      ],
      "x_nadsec_orgs": [
        "CBVISION S.A."
      ]
    },
    {
      "created": "2026-04-21T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--38884418-ad1a-41a1-b2b2-c29d05326311",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '54.210.22.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T01:05:03.000Z",
      "valid_until": "2026-05-23T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T00:54:02.528Z",
      "x_nadsec_last_seen": "2026-04-21T00:54:02.528Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-21T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NP; asn=23752; asn_org=Nepal Telecommunications Corporation, Internet Services",
      "id": "indicator--537330be-8333-45a2-9ee3-6f93c34a5afd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.199.225.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T02:05:10.000Z",
      "valid_until": "2026-05-23T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-21T01:28:58.473Z",
      "x_nadsec_last_seen": "2026-04-21T01:31:03.359Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NP"
      ],
      "x_nadsec_asns": [
        "23752"
      ],
      "x_nadsec_orgs": [
        "Nepal Telecommunications Corporation, Internet Services"
      ]
    },
    {
      "created": "2026-04-21T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--90216e02-ed2b-4083-846b-227634b89946",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '161.35.114.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T02:05:10.000Z",
      "valid_until": "2026-05-23T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T01:08:40.585Z",
      "x_nadsec_last_seen": "2026-04-21T01:08:40.585Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-21T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--cc88c00a-3871-42bc-a008-f41ba45a426a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.86.89.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T02:05:10.000Z",
      "valid_until": "2026-05-23T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-21T01:06:43.243Z",
      "x_nadsec_last_seen": "2026-04-21T01:08:48.199Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-04-21T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--292f30ea-ad23-4f96-956a-12df7fd61c35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.74.208.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T02:05:10.000Z",
      "valid_until": "2026-05-23T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T01:47:38.300Z",
      "x_nadsec_last_seen": "2026-04-21T01:47:48.459Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-21T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--b505cd99-236d-4773-b1e1-c88d5e79157d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '105.96.62.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T03:05:03.000Z",
      "valid_until": "2026-05-23T03:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T02:39:42.885Z",
      "x_nadsec_last_seen": "2026-04-21T02:39:43.160Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-04-21T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--06090c78-c725-4284-8c5e-3715b28923a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.163.6.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T03:05:03.000Z",
      "valid_until": "2026-05-23T03:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-21T02:37:18.137Z",
      "x_nadsec_last_seen": "2026-04-21T02:39:28.992Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-21T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--82f89771-6bbe-41c9-a89f-46ba0bbbe670",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.182.170.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T03:05:03.000Z",
      "valid_until": "2026-05-23T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T02:15:16.225Z",
      "x_nadsec_last_seen": "2026-04-21T02:15:16.225Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-21T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--1a1b9be1-21d8-432e-a45e-3a221787f0d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.202.104.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T03:05:03.000Z",
      "valid_until": "2026-05-23T03:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T02:28:58.117Z",
      "x_nadsec_last_seen": "2026-04-28T10:22:04.446Z",
      "x_nadsec_ports": [
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-21T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--b26d2ed1-3a53-46d1-9c26-77c350d73d84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.9.1.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T03:05:03.000Z",
      "valid_until": "2026-05-23T03:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-21T03:03:56.642Z",
      "x_nadsec_last_seen": "2026-04-21T03:12:19.650Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-04-21T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--61c03249-b01f-4fc0-a8d0-313770b7217c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T03:05:03.000Z",
      "valid_until": "2026-05-23T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T02:28:03.359Z",
      "x_nadsec_last_seen": "2026-04-21T02:28:03.359Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-21T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=DE; asn=3320; asn_org=Deutsche Telekom AG",
      "id": "indicator--2482bdc5-2b45-41e0-b28c-6a27f25620e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '62.157.25.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T03:05:03.000Z",
      "valid_until": "2026-05-23T03:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-21T02:48:50.343Z",
      "x_nadsec_last_seen": "2026-04-21T02:56:00.030Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "3320"
      ],
      "x_nadsec_orgs": [
        "Deutsche Telekom AG"
      ]
    },
    {
      "created": "2026-04-21T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--8a4d0218-6f8b-460b-88bc-3ccd87cf41f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T03:05:03.000Z",
      "valid_until": "2026-05-23T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T02:41:00.108Z",
      "x_nadsec_last_seen": "2026-04-21T02:41:00.108Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-21T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--95316d0d-067b-4286-a78e-07057c023d2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T03:05:03.000Z",
      "valid_until": "2026-05-23T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T02:32:43.518Z",
      "x_nadsec_last_seen": "2026-04-21T02:32:43.518Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-21T04:05:24.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=HR; asn=31012; asn_org=A1 Hrvatska d.o.o.",
      "id": "indicator--fc0e5ad7-4ad6-465a-8fed-34b88a9e9e55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T04:05:24.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '188.252.188.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T04:05:24.000Z",
      "valid_until": "2026-05-23T04:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T03:32:37.612Z",
      "x_nadsec_last_seen": "2026-04-21T03:32:37.710Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HR"
      ],
      "x_nadsec_asns": [
        "31012"
      ],
      "x_nadsec_orgs": [
        "A1 Hrvatska d.o.o."
      ]
    },
    {
      "created": "2026-04-21T04:05:24.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--97eebd2e-334c-4439-a196-317bb11fa107",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T04:05:24.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '27.64.16.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T04:05:24.000Z",
      "valid_until": "2026-05-23T04:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-21T03:59:31.281Z",
      "x_nadsec_last_seen": "2026-04-21T04:05:22.463Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-21T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--7b8a29ad-a669-4061-ac3d-8c4b822c391a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T05:05:10.000Z",
      "valid_until": "2026-05-23T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T05:00:12.932Z",
      "x_nadsec_last_seen": "2026-04-21T05:00:12.932Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-21T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a9e51fec-63f9-4c35-92fb-6f07f1f9eb69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.183.141.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T05:05:10.000Z",
      "valid_until": "2026-05-23T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T04:48:39.869Z",
      "x_nadsec_last_seen": "2026-04-21T04:48:39.869Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-21T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=KR; asn=45382; asn_org=Hostcenter",
      "id": "indicator--60e7f5b1-0871-4c63-b5a4-2237aa8520b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '121.78.158.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T06:05:10.000Z",
      "valid_until": "2026-05-23T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T05:39:08.826Z",
      "x_nadsec_last_seen": "2026-04-21T05:39:08.871Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "45382"
      ],
      "x_nadsec_orgs": [
        "Hostcenter"
      ]
    },
    {
      "created": "2026-04-21T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PK; asn=9260; asn_org=Multinet Pakistan Pvt. Ltd.",
      "id": "indicator--24c4e96e-1d26-47a5-a913-1200f4428772",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '125.209.98.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T06:05:10.000Z",
      "valid_until": "2026-05-23T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T05:39:41.823Z",
      "x_nadsec_last_seen": "2026-04-21T05:39:41.823Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9260"
      ],
      "x_nadsec_orgs": [
        "Multinet Pakistan Pvt. Ltd."
      ]
    },
    {
      "created": "2026-04-21T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--ca45eeab-ae3d-4014-b5ff-ce5b2f648771",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T06:05:10.000Z",
      "valid_until": "2026-05-23T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-11T14:26:10.392Z",
      "x_nadsec_last_seen": "2026-04-25T12:11:47.730Z",
      "x_nadsec_ports": [
        "445",
        "81",
        "1723",
        "1883"
      ],
      "x_nadsec_services": [
        "smbd",
        "httpd",
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-21T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--69d94431-5f3f-404d-85f7-e57237341adc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '39.53.192.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T06:05:10.000Z",
      "valid_until": "2026-05-23T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T05:39:41.656Z",
      "x_nadsec_last_seen": "2026-04-21T05:39:42.353Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-04-21T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8a5dcec0-75b2-49af-aa41-87139d75a86c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T06:05:10.000Z",
      "valid_until": "2026-05-23T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T05:49:34.473Z",
      "x_nadsec_last_seen": "2026-04-21T05:49:34.473Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-21T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--7bcc0851-7b04-442f-9015-ceca99b8ac3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T06:05:10.000Z",
      "valid_until": "2026-05-23T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T05:10:56.888Z",
      "x_nadsec_last_seen": "2026-04-21T05:10:56.888Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-21T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3131330e-470b-4e1a-87c5-9df2d3181696",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T06:05:10.000Z",
      "valid_until": "2026-05-23T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T05:11:07.242Z",
      "x_nadsec_last_seen": "2026-04-21T05:11:07.242Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-21T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=httpd; ports=81; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--f1b199eb-5bb9-45c7-8022-6e25a4ca14ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T07:05:13.000Z",
      "valid_until": "2026-05-23T07:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-21T06:27:21.122Z",
      "x_nadsec_last_seen": "2026-04-21T06:27:50.000Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-21T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--698b5656-c1e3-4ad2-a689-fec8b7ed59fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T07:05:13.000Z",
      "valid_until": "2026-05-23T07:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-21T06:33:22.382Z",
      "x_nadsec_last_seen": "2026-04-21T06:33:23.127Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-21T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e208436d-90fe-42a6-840c-4103c0cd401b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '209.38.224.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T07:05:13.000Z",
      "valid_until": "2026-05-23T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T06:43:09.661Z",
      "x_nadsec_last_seen": "2026-04-21T06:43:10.221Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-21T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--f7c17cc7-d8e6-4a3b-832b-4e8e704efd4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.22.140.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T07:05:13.000Z",
      "valid_until": "2026-05-23T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T06:37:49.344Z",
      "x_nadsec_last_seen": "2026-04-27T16:53:27.314Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-21T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=RO; asn=214295; asn_org=Skynet Network Ltd",
      "id": "indicator--899516e4-de68-4bed-b408-abc9408e82e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.142.193.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T07:05:13.000Z",
      "valid_until": "2026-05-23T07:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-21T06:54:54.274Z",
      "x_nadsec_last_seen": "2026-04-28T08:03:17.213Z",
      "x_nadsec_ports": [
        "445",
        "1883"
      ],
      "x_nadsec_services": [
        "smbd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "RO"
      ],
      "x_nadsec_asns": [
        "214295"
      ],
      "x_nadsec_orgs": [
        "Skynet Network Ltd"
      ]
    },
    {
      "created": "2026-04-21T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--6723ed11-9180-4716-a613-336eead2acbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T07:05:13.000Z",
      "valid_until": "2026-05-23T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T06:07:33.899Z",
      "x_nadsec_last_seen": "2026-04-21T06:07:33.899Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-04-21T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--647aaeae-feaa-4468-9016-d3d95195c282",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.101.174.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T07:05:13.000Z",
      "valid_until": "2026-05-23T07:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-04-21T06:41:59.201Z",
      "x_nadsec_last_seen": "2026-04-21T06:43:01.821Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-21T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--aa477a97-f019-4b55-97bd-f57e6a938336",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '60.191.209.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T07:05:13.000Z",
      "valid_until": "2026-05-23T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T06:42:12.193Z",
      "x_nadsec_last_seen": "2026-04-21T06:44:20.510Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-21T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--9133bb7a-3fdc-4fd0-be55-d5f9ef46471b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T07:05:13.000Z",
      "valid_until": "2026-05-23T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T06:34:05.546Z",
      "x_nadsec_last_seen": "2026-04-29T12:34:41.876Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-21T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--89e15fbb-4907-47a9-84e5-91fbf4ac0a84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T07:05:13.000Z",
      "valid_until": "2026-05-23T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T06:38:02.348Z",
      "x_nadsec_last_seen": "2026-04-24T08:34:17.436Z",
      "x_nadsec_ports": [
        "1723",
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-21T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--1ead8dc2-35b6-4c15-b81e-c02022aa8eb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.183.19.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T07:05:13.000Z",
      "valid_until": "2026-05-23T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T06:49:04.892Z",
      "x_nadsec_last_seen": "2026-04-21T06:49:08.180Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-21T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=151164; asn_org=Wireline Communication India Private Limited",
      "id": "indicator--a84c70d3-d520-4290-848a-ee3e0bb0f8c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.115.236.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T08:05:05.000Z",
      "valid_until": "2026-05-23T08:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-21T07:42:30.332Z",
      "x_nadsec_last_seen": "2026-04-21T07:44:34.931Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "151164"
      ],
      "x_nadsec_orgs": [
        "Wireline Communication India Private Limited"
      ]
    },
    {
      "created": "2026-04-21T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--69c310f0-70b9-4931-92d8-c46f85b57880",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.236.113.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T08:05:05.000Z",
      "valid_until": "2026-05-23T08:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T07:51:32.164Z",
      "x_nadsec_last_seen": "2026-04-21T07:51:32.164Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-21T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--a96f4fe7-c764-4db7-bd8d-21be45422e8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '115.76.54.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T08:05:05.000Z",
      "valid_until": "2026-05-23T08:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-21T07:20:09.130Z",
      "x_nadsec_last_seen": "2026-04-21T07:26:42.918Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-21T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--fbe0a8ec-7cd3-437a-bcd4-43f9bd23cb78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '122.160.53.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T08:05:05.000Z",
      "valid_until": "2026-05-23T08:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-21T07:53:40.518Z",
      "x_nadsec_last_seen": "2026-04-21T07:55:47.584Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-04-21T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--fcbf5860-4876-495e-bf94-58cf651636d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '150.107.38.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T08:05:05.000Z",
      "valid_until": "2026-05-23T08:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-21T07:40:42.133Z",
      "x_nadsec_last_seen": "2026-04-21T07:41:10.859Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-21T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--953dd0b3-7591-4c66-97f5-f50a1f3e9977",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '161.35.116.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T08:05:05.000Z",
      "valid_until": "2026-05-23T08:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T07:49:49.124Z",
      "x_nadsec_last_seen": "2026-04-21T20:30:48.988Z",
      "x_nadsec_ports": [
        "1433",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-21T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--bb3e8f04-79d2-4d5e-bc90-0003228e4830",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '161.35.197.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T08:05:05.000Z",
      "valid_until": "2026-05-23T08:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T07:56:12.612Z",
      "x_nadsec_last_seen": "2026-04-21T07:56:13.184Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-21T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--fec158a9-3a32-4fbf-aeac-d349b4fbc167",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.245.219.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T08:05:05.000Z",
      "valid_until": "2026-05-23T08:05:04.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-04-21T07:55:02.089Z",
      "x_nadsec_last_seen": "2026-04-21T07:56:04.699Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-21T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=31; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--d26431aa-7942-4135-80fe-521c9a7769e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '174.138.40.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T08:05:05.000Z",
      "valid_until": "2026-05-23T08:05:04.000Z",
      "x_nadsec_event_count": 31,
      "x_nadsec_first_seen": "2026-04-21T07:46:56.502Z",
      "x_nadsec_last_seen": "2026-04-21T07:49:45.924Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-21T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--9ea9da1d-955a-43bc-8de3-8a1f7354a0cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.202.39.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T08:05:05.000Z",
      "valid_until": "2026-05-23T08:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-21T08:01:32.688Z",
      "x_nadsec_last_seen": "2026-04-21T08:03:39.638Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-21T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--c5a482ee-82d8-4257-8c8c-9a75a954a774",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '213.14.29.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T08:05:05.000Z",
      "valid_until": "2026-05-23T08:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-21T07:56:20.392Z",
      "x_nadsec_last_seen": "2026-04-21T08:03:23.743Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-04-21T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=HK; asn=9381; asn_org=HKBN Enterprise Solutions HK Limited",
      "id": "indicator--c9357cd6-f8f4-424d-89fe-e328a242631b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '223.255.177.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T08:05:05.000Z",
      "valid_until": "2026-05-23T08:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-21T07:57:57.448Z",
      "x_nadsec_last_seen": "2026-04-25T23:07:42.011Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9381"
      ],
      "x_nadsec_orgs": [
        "HKBN Enterprise Solutions HK Limited"
      ]
    },
    {
      "created": "2026-04-21T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--70687746-088c-4769-a69b-5d70cb92226c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '52.137.109.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T08:05:05.000Z",
      "valid_until": "2026-05-23T08:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-21T07:58:28.217Z",
      "x_nadsec_last_seen": "2026-04-21T07:58:29.493Z",
      "x_nadsec_ports": [
        "135",
        "445"
      ],
      "x_nadsec_services": [
        "epmapper",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-21T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--00920327-b599-428c-a027-56ed02955d99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T08:05:05.000Z",
      "valid_until": "2026-05-23T08:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-21T07:31:31.224Z",
      "x_nadsec_last_seen": "2026-04-28T05:32:11.573Z",
      "x_nadsec_ports": [
        "445",
        "1883",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "mongod",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-21T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--9415805a-39a5-4f74-af67-3ba541d9d758",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T08:05:05.000Z",
      "valid_until": "2026-05-23T08:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T07:18:18.459Z",
      "x_nadsec_last_seen": "2026-04-21T07:18:18.459Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-21T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=133661; asn_org=Netplus Broadband Services Private Limited",
      "id": "indicator--216c715d-bf73-49cd-a8c9-c7418dab1593",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.181.154.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T09:05:10.000Z",
      "valid_until": "2026-05-23T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-21T09:04:07.822Z",
      "x_nadsec_last_seen": "2026-04-21T09:10:52.027Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133661"
      ],
      "x_nadsec_orgs": [
        "Netplus Broadband Services Private Limited"
      ]
    },
    {
      "created": "2026-04-21T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=VN; asn=152979; asn_org=Vietservice Technology Company Limited; user(top)=**",
      "id": "indicator--9dca88f4-678a-48aa-b6e7-e85b408f419f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '160.30.160.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T10:05:10.000Z",
      "valid_until": "2026-05-23T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T10:01:43.598Z",
      "x_nadsec_last_seen": "2026-04-21T10:01:43.598Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "152979"
      ],
      "x_nadsec_orgs": [
        "Vietservice Technology Company Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-21T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=PH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--14199dee-946c-4030-96c0-f78a988ea38b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.100.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T10:05:10.000Z",
      "valid_until": "2026-05-23T10:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-21T09:58:34.931Z",
      "x_nadsec_last_seen": "2026-04-21T09:59:42.640Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-21T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--8e7c50b0-5e74-4ef2-bd9e-ffef4dc44ff2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.176.78.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T10:05:10.000Z",
      "valid_until": "2026-05-23T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-21T09:49:50.998Z",
      "x_nadsec_last_seen": "2026-04-21T09:54:39.958Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-04-21T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=KZ; asn=60757; asn_org=Optinet LLP",
      "id": "indicator--2797d98a-c8c9-449a-9f93-822c7b406002",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.217.188.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T10:05:10.000Z",
      "valid_until": "2026-05-23T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T09:54:47.043Z",
      "x_nadsec_last_seen": "2026-04-21T09:54:47.111Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "60757"
      ],
      "x_nadsec_orgs": [
        "Optinet LLP"
      ]
    },
    {
      "created": "2026-04-21T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MY; asn=9930; asn_org=TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al",
      "id": "indicator--d5abe141-a922-4b07-85dd-c9402787a147",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '202.184.116.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T10:05:10.000Z",
      "valid_until": "2026-05-23T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-21T09:45:31.827Z",
      "x_nadsec_last_seen": "2026-04-21T09:45:37.941Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "9930"
      ],
      "x_nadsec_orgs": [
        "TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al"
      ]
    },
    {
      "created": "2026-04-21T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--496f9dab-99b8-4cf0-9954-0110da278cae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T10:05:10.000Z",
      "valid_until": "2026-05-23T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T09:34:02.399Z",
      "x_nadsec_last_seen": "2026-04-21T09:34:02.399Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-04-21T11:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1857; services=smbd; ports=445; cc=BD; asn=131340; asn_org=Md. Mozammel Hoque ta Taqwa IT",
      "id": "indicator--49d3a5e8-5d71-4152-99af-195526829865",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T11:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.74.228.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T11:05:06.000Z",
      "valid_until": "2026-05-23T11:05:04.000Z",
      "x_nadsec_event_count": 3148,
      "x_nadsec_first_seen": "2026-04-21T10:44:03.642Z",
      "x_nadsec_last_seen": "2026-04-21T11:16:51.020Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "131340"
      ],
      "x_nadsec_orgs": [
        "Md. Mozammel Hoque ta Taqwa IT"
      ]
    },
    {
      "created": "2026-04-21T11:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2473; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--5decd910-98cc-4509-9d83-1f7c7b4995b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T11:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.241.200.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T11:05:06.000Z",
      "valid_until": "2026-05-23T11:05:04.000Z",
      "x_nadsec_event_count": 3150,
      "x_nadsec_first_seen": "2026-04-21T10:12:50.733Z",
      "x_nadsec_last_seen": "2026-04-21T11:16:03.229Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-04-21T11:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--27c2eb68-2eea-4d57-b97f-fa2baf3c6404",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T11:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T11:05:06.000Z",
      "valid_until": "2026-05-23T11:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T10:53:36.346Z",
      "x_nadsec_last_seen": "2026-04-21T10:53:36.346Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-21T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--6e01f938-674d-492f-a003-e7cf711e087a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.91.4.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T12:05:10.000Z",
      "valid_until": "2026-05-23T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T11:27:15.123Z",
      "x_nadsec_last_seen": "2026-04-21T11:27:15.123Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-04-21T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--6b8ac1f5-2fe1-429e-be12-a9a14238a5ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.193.45.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T12:05:10.000Z",
      "valid_until": "2026-05-23T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T11:13:05.334Z",
      "x_nadsec_last_seen": "2026-04-21T11:13:05.334Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-21T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--36b4a786-0d86-44d3-8d5f-a9e1c76e29ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '151.250.116.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T12:05:10.000Z",
      "valid_until": "2026-05-23T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-21T11:05:58.596Z",
      "x_nadsec_last_seen": "2026-04-21T11:08:05.600Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-04-21T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--5837a1ec-74ea-4036-9f49-4e3ab3cb6258",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.210.70.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T12:05:10.000Z",
      "valid_until": "2026-05-23T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T11:29:22.689Z",
      "x_nadsec_last_seen": "2026-04-21T11:29:22.689Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-04-21T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--ead2ca26-f464-4715-bb97-c33b8c253e64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.210.70.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T12:05:10.000Z",
      "valid_until": "2026-05-23T12:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T11:27:15.571Z",
      "x_nadsec_last_seen": "2026-04-21T11:29:20.672Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-04-21T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=141856; asn_org=A S C S C DIGITAL PRIVATE LIMITED",
      "id": "indicator--9c650e11-dbdb-4f21-97b7-6decae5c48ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.168.95.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T13:05:10.000Z",
      "valid_until": "2026-05-23T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-21T12:24:11.200Z",
      "x_nadsec_last_seen": "2026-04-21T12:26:24.572Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "141856"
      ],
      "x_nadsec_orgs": [
        "A S C S C DIGITAL PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-04-21T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=133275; asn_org=Gigantic Infotel Pvt Ltd",
      "id": "indicator--13f55874-1f67-47f3-873d-aad525efe922",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.59.195.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T13:05:10.000Z",
      "valid_until": "2026-05-23T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T12:48:36.290Z",
      "x_nadsec_last_seen": "2026-04-21T12:48:36.290Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133275"
      ],
      "x_nadsec_orgs": [
        "Gigantic Infotel Pvt Ltd"
      ]
    },
    {
      "created": "2026-04-21T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--2941e526-0011-41f3-b365-f5adc6e7d81d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '123.24.50.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T13:05:10.000Z",
      "valid_until": "2026-05-23T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T12:08:21.159Z",
      "x_nadsec_last_seen": "2026-04-21T12:08:21.159Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-21T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--64366d13-38df-4072-ab23-690b7b3c8b2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.172.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T13:05:10.000Z",
      "valid_until": "2026-05-23T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T12:16:30.218Z",
      "x_nadsec_last_seen": "2026-04-21T12:16:30.218Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-21T14:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--ae80e489-f635-44f0-a1a9-57f4effd6777",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T14:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.193.57.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T14:05:05.000Z",
      "valid_until": "2026-05-23T14:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-20T00:15:06.414Z",
      "x_nadsec_last_seen": "2026-04-21T13:50:10.707Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-21T14:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e8f1921e-a031-4ee9-b96c-01cdf5bfe7b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T14:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '168.144.91.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T14:05:05.000Z",
      "valid_until": "2026-05-23T14:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T13:11:09.607Z",
      "x_nadsec_last_seen": "2026-04-21T13:11:09.607Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-21T14:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--2addf4d7-8a01-4726-a08a-0dba8bb04504",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T14:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.210.9.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T14:05:05.000Z",
      "valid_until": "2026-05-23T14:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-21T13:58:29.461Z",
      "x_nadsec_last_seen": "2026-04-21T13:58:30.268Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-21T14:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=3269; asn_org=TIM",
      "id": "indicator--4473dcbf-3ae1-4ca9-a8a0-85cfe796610b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T14:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '188.12.107.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T14:05:05.000Z",
      "valid_until": "2026-05-23T14:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-21T13:21:06.060Z",
      "x_nadsec_last_seen": "2026-04-21T13:23:12.559Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "3269"
      ],
      "x_nadsec_orgs": [
        "TIM"
      ]
    },
    {
      "created": "2026-04-21T14:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=9676; asn_org=SaveCom Internation Inc.",
      "id": "indicator--a7ab26e1-facd-4b12-9bae-f4c7014b963f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T14:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '60.245.60.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T14:05:05.000Z",
      "valid_until": "2026-05-23T14:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T13:12:15.760Z",
      "x_nadsec_last_seen": "2026-04-21T13:12:16.548Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "9676"
      ],
      "x_nadsec_orgs": [
        "SaveCom Internation Inc."
      ]
    },
    {
      "created": "2026-04-21T14:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--5e6595e4-7af2-4c2e-a4c4-d0bf4e60a7c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T14:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T14:05:05.000Z",
      "valid_until": "2026-05-23T14:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T14:01:40.431Z",
      "x_nadsec_last_seen": "2026-04-25T14:10:21.389Z",
      "x_nadsec_ports": [
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-21T14:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--cbd93c93-ab83-410e-b2db-c26e3b8f7c6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T14:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T14:05:05.000Z",
      "valid_until": "2026-05-23T14:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T13:53:29.004Z",
      "x_nadsec_last_seen": "2026-04-21T13:53:29.004Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-21T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MA; asn=6713; asn_org=Itissalat Al-MAGHRIB; user(top)=**",
      "id": "indicator--83f93e34-a0ad-42eb-83f1-0bef8e174d83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '105.159.248.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T15:05:10.000Z",
      "valid_until": "2026-05-23T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T15:03:43.855Z",
      "x_nadsec_last_seen": "2026-04-21T15:03:43.855Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "6713"
      ],
      "x_nadsec_orgs": [
        "Itissalat Al-MAGHRIB"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-21T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--40690dcd-a764-4355-a9a2-0ce51c7940f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.2.132.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T16:05:11.000Z",
      "valid_until": "2026-05-23T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-21T15:13:28.904Z",
      "x_nadsec_last_seen": "2026-04-21T15:15:33.697Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-04-21T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--d30ae4df-6cd6-4824-bb18-c5b1c3668f0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T16:05:11.000Z",
      "valid_until": "2026-05-23T16:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-21T15:33:35.566Z",
      "x_nadsec_last_seen": "2026-04-29T10:10:47.197Z",
      "x_nadsec_ports": [
        "445",
        "1883"
      ],
      "x_nadsec_services": [
        "smbd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-21T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=18881; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--ce9f38c2-6093-4c57-91c6-4cf6d4b21b67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '187.59.156.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T16:05:11.000Z",
      "valid_until": "2026-05-23T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T15:27:42.914Z",
      "x_nadsec_last_seen": "2026-04-21T15:27:51.894Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "18881"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-04-21T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--66704f55-6eee-494b-91e4-8b2991abcb91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T16:05:11.000Z",
      "valid_until": "2026-05-23T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T15:57:37.331Z",
      "x_nadsec_last_seen": "2026-04-22T06:37:47.394Z",
      "x_nadsec_ports": [
        "81",
        "1433"
      ],
      "x_nadsec_services": [
        "httpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-21T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=EG; asn=24863; asn_org=LINKdotNET; user(top)=**",
      "id": "indicator--a5b6cc12-6105-485a-8c9d-5d77ec138527",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.247.67.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T16:05:11.000Z",
      "valid_until": "2026-05-23T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T15:10:13.705Z",
      "x_nadsec_last_seen": "2026-04-21T15:10:15.327Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24863"
      ],
      "x_nadsec_orgs": [
        "LINKdotNET"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-21T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e14d725b-9b5b-451d-bb47-045dbaffa4a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '52.180.157.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T16:05:11.000Z",
      "valid_until": "2026-05-23T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T15:14:34.776Z",
      "x_nadsec_last_seen": "2026-04-21T15:14:44.951Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-21T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--8378a1c3-ac1e-4332-8a6b-d3609f44404b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T16:05:11.000Z",
      "valid_until": "2026-05-23T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T15:09:51.975Z",
      "x_nadsec_last_seen": "2026-04-22T19:27:15.672Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-21T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=58309; asn_org=Langate Ltd",
      "id": "indicator--75869bda-636b-4562-9e4d-d73bdf6ef0ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '109.229.27.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T17:05:13.000Z",
      "valid_until": "2026-05-23T17:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-21T16:14:29.537Z",
      "x_nadsec_last_seen": "2026-04-21T16:14:35.580Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "58309"
      ],
      "x_nadsec_orgs": [
        "Langate Ltd"
      ]
    },
    {
      "created": "2026-04-21T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=IR; asn=213790; asn_org=Limited Network LTD",
      "id": "indicator--d616489e-d714-40ad-a552-abbad76c0a27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T17:05:13.000Z",
      "valid_until": "2026-05-23T17:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-21T16:37:05.239Z",
      "x_nadsec_last_seen": "2026-04-27T10:59:30.756Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IR"
      ],
      "x_nadsec_asns": [
        "213790"
      ],
      "x_nadsec_orgs": [
        "Limited Network LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-21T18:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45458; asn_org=SBN-ISPAWN-ISP and SBN-NIXAWN-NIX",
      "id": "indicator--c19d175d-7369-45f3-8415-b0d0d2c7d7bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T18:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.50.221.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T18:05:08.000Z",
      "valid_until": "2026-05-23T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-21T17:36:45.176Z",
      "x_nadsec_last_seen": "2026-04-21T17:38:49.596Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45458"
      ],
      "x_nadsec_orgs": [
        "SBN-ISPAWN-ISP and SBN-NIXAWN-NIX"
      ]
    },
    {
      "created": "2026-04-21T18:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--0c058bcf-2bdd-46c0-af40-25a7d3170ae6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T18:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.234.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T18:05:08.000Z",
      "valid_until": "2026-05-23T18:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-18T00:26:02.497Z",
      "x_nadsec_last_seen": "2026-04-21T17:27:36.747Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-21T18:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--909e3cf7-4c1c-4310-9858-25bd0a824009",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T18:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.97.26.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T18:05:08.000Z",
      "valid_until": "2026-05-23T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T17:12:26.255Z",
      "x_nadsec_last_seen": "2026-04-21T17:12:26.255Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-21T18:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--52e059ff-e940-4701-9f3a-854a87ab3744",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T18:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T18:05:08.000Z",
      "valid_until": "2026-05-23T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T17:09:50.517Z",
      "x_nadsec_last_seen": "2026-04-21T17:09:50.517Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-21T18:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--07fc2dfd-54af-4058-8420-0758d98dea95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T18:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.124.174.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T18:05:08.000Z",
      "valid_until": "2026-05-23T18:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T18:00:55.574Z",
      "x_nadsec_last_seen": "2026-04-21T18:00:55.897Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-21T18:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--e51278c9-5d79-4ac7-b676-150521a6e9e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T18:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T18:05:08.000Z",
      "valid_until": "2026-05-23T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T17:30:43.690Z",
      "x_nadsec_last_seen": "2026-04-21T17:30:43.690Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-21T19:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--4211ca5d-d958-4a7d-966c-f6c098a3de38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T19:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.162.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T19:05:02.000Z",
      "valid_until": "2026-05-23T19:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-21T18:45:04.253Z",
      "x_nadsec_last_seen": "2026-04-21T18:45:26.616Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-21T19:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=DE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--d2d9c6b2-f26d-4430-a232-83fea541a5a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T19:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.164.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T19:05:02.000Z",
      "valid_until": "2026-05-23T19:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-21T18:28:09.828Z",
      "x_nadsec_last_seen": "2026-04-21T18:28:39.273Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-21T19:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--6bad3617-a5f1-429e-81b6-eb52d4127f46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T19:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.127.152.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T19:05:02.000Z",
      "valid_until": "2026-05-23T19:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T18:25:38.223Z",
      "x_nadsec_last_seen": "2026-04-21T18:25:38.223Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-21T19:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=28656; asn_org=BTT TELECOMUNICACOES S.A.; user(top)=**",
      "id": "indicator--8914d111-4ac1-4d0b-a3c0-d5cc50e84bab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T19:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.190.118.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T19:05:02.000Z",
      "valid_until": "2026-05-23T19:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T18:55:14.963Z",
      "x_nadsec_last_seen": "2026-04-21T18:55:14.963Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28656"
      ],
      "x_nadsec_orgs": [
        "BTT TELECOMUNICACOES S.A."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-21T19:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=JO; asn=8376; asn_org=Jordan Data Communications Company LLC",
      "id": "indicator--e6b4e842-9315-4527-b3a3-4259b087ffe8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T19:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '92.253.102.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T19:05:02.000Z",
      "valid_until": "2026-05-23T19:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T18:43:45.142Z",
      "x_nadsec_last_seen": "2026-04-21T18:43:46.512Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "8376"
      ],
      "x_nadsec_orgs": [
        "Jordan Data Communications Company LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-21T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--ad1a30b7-8ba2-411e-a71e-91fd6d234475",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T22:05:11.000Z",
      "valid_until": "2026-05-23T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T21:24:23.654Z",
      "x_nadsec_last_seen": "2026-04-21T21:24:24.025Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-04-21T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=11664; asn_org=Techtel LMDS Comunicaciones Interactivas S.A.",
      "id": "indicator--0cfe1d7c-9f0f-415d-b7f7-bc6b9e68e07d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.221.10.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T22:05:11.000Z",
      "valid_until": "2026-05-23T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-21T21:32:28.494Z",
      "x_nadsec_last_seen": "2026-04-21T21:34:35.664Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "11664"
      ],
      "x_nadsec_orgs": [
        "Techtel LMDS Comunicaciones Interactivas S.A."
      ]
    },
    {
      "created": "2026-04-21T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--be129a9f-4a79-4529-a8e5-197fdd7a0fae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T22:05:11.000Z",
      "valid_until": "2026-05-23T22:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-21T21:34:50.906Z",
      "x_nadsec_last_seen": "2026-04-21T21:34:51.490Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-21T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--afeff3b8-d66c-4eb7-b768-d37b3f37a7d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T22:05:11.000Z",
      "valid_until": "2026-05-23T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T21:05:58.103Z",
      "x_nadsec_last_seen": "2026-04-21T21:05:58.103Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-21T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--88ab386b-319d-4876-a81e-24cf9706edb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T22:05:11.000Z",
      "valid_until": "2026-05-23T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T21:05:36.772Z",
      "x_nadsec_last_seen": "2026-04-21T21:05:36.772Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-21T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--12002d78-5c2b-4757-9277-cef4b16fdcc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T22:05:11.000Z",
      "valid_until": "2026-05-23T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T21:05:36.566Z",
      "x_nadsec_last_seen": "2026-04-21T21:05:36.566Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-21T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--a85eabb9-6b4c-4bc5-91bf-9917820a3168",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T22:05:11.000Z",
      "valid_until": "2026-05-23T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T21:06:08.319Z",
      "x_nadsec_last_seen": "2026-04-21T21:06:08.319Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-21T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--091e6545-9fac-4d3b-87aa-b3ea491c6e40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.20.150.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T23:05:10.000Z",
      "valid_until": "2026-05-23T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-21T22:20:36.391Z",
      "x_nadsec_last_seen": "2026-04-21T22:22:41.060Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-04-21T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6df6ead4-b827-4ab3-9600-44e22397d5c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '137.184.217.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T23:05:10.000Z",
      "valid_until": "2026-05-23T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T22:44:02.756Z",
      "x_nadsec_last_seen": "2026-04-21T22:44:02.756Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-21T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--49b96ed3-e469-4bef-a950-79b5d759b2e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.244.154.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T23:05:10.000Z",
      "valid_until": "2026-05-23T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T22:44:03.822Z",
      "x_nadsec_last_seen": "2026-04-21T22:44:03.822Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-21T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=VN; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--104d1423-1731-49f8-aef3-5c6d7aee10e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.250.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T23:05:10.000Z",
      "valid_until": "2026-05-23T23:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-21T22:52:22.460Z",
      "x_nadsec_last_seen": "2026-04-23T03:24:51.244Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-21T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--c8501f5b-8c20-484c-bbe3-49b832e958f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '159.223.187.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T23:05:10.000Z",
      "valid_until": "2026-05-23T23:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-21T22:44:03.816Z",
      "x_nadsec_last_seen": "2026-04-22T07:59:28.074Z",
      "x_nadsec_ports": [
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-21T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=46606; asn_org=Unified Layer; user(top)=**",
      "id": "indicator--ec6c87ad-652c-453f-badc-1dcc15e37fab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '162.214.98.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T23:05:10.000Z",
      "valid_until": "2026-05-23T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T22:12:50.961Z",
      "x_nadsec_last_seen": "2026-04-21T22:12:50.961Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "46606"
      ],
      "x_nadsec_orgs": [
        "Unified Layer"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-21T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e8fb6719-e83c-41f0-a243-47a432d87563",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T23:05:10.000Z",
      "valid_until": "2026-05-23T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T22:27:35.728Z",
      "x_nadsec_last_seen": "2026-04-21T22:27:35.728Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-21T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--aaa28a6a-6a41-4109-a43a-f424f9bb275c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '211.138.170.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T23:05:10.000Z",
      "valid_until": "2026-05-23T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T22:32:27.609Z",
      "x_nadsec_last_seen": "2026-04-21T22:32:27.609Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-04-21T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=NL; asn=215540; asn_org=Global Connectivity Solutions Llp",
      "id": "indicator--1153bd59-88dc-48e0-94fd-e335e980f445",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.82.13.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T23:05:10.000Z",
      "valid_until": "2026-05-23T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T22:10:32.570Z",
      "x_nadsec_last_seen": "2026-04-21T22:10:32.570Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "215540"
      ],
      "x_nadsec_orgs": [
        "Global Connectivity Solutions Llp"
      ]
    },
    {
      "created": "2026-04-21T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=GR; asn=197580; asn_org=Connecticore Telecommunications Information Technology S.A",
      "id": "indicator--1098957f-4bea-430b-b485-0932bb4a3d65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '83.174.149.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T23:05:10.000Z",
      "valid_until": "2026-05-23T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T22:08:36.874Z",
      "x_nadsec_last_seen": "2026-04-21T22:08:36.874Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GR"
      ],
      "x_nadsec_asns": [
        "197580"
      ],
      "x_nadsec_orgs": [
        "Connecticore Telecommunications Information Technology S.A"
      ]
    },
    {
      "created": "2026-04-22T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--478dd212-e301-400d-a3f1-759e68c3c8b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '120.253.53.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T00:05:11.000Z",
      "valid_until": "2026-05-24T00:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-22T00:04:50.988Z",
      "x_nadsec_last_seen": "2026-04-22T00:11:23.526Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-04-22T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--83f995d5-5f3b-4395-896a-cd9e4b195b23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T00:05:11.000Z",
      "valid_until": "2026-05-24T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T23:28:27.028Z",
      "x_nadsec_last_seen": "2026-04-21T23:28:37.222Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-22T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=NL; asn=16276; asn_org=OVH SAS; user(top)=**; pass(top)=***",
      "id": "indicator--6fad9ead-1d6e-4cff-b249-f0f3820a19f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '141.11.187.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T00:05:11.000Z",
      "valid_until": "2026-05-24T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T23:26:00.604Z",
      "x_nadsec_last_seen": "2026-04-21T23:26:00.604Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "***"
      ]
    },
    {
      "created": "2026-04-22T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--960bd210-1721-4d75-a3a4-a919913b8c76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.65.149.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T00:05:11.000Z",
      "valid_until": "2026-05-24T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T23:34:33.194Z",
      "x_nadsec_last_seen": "2026-04-24T12:12:53.330Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-04-22T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=48524; asn_org=INTERRA telecommunications group, Ltd.",
      "id": "indicator--e45d6dd7-9d72-45b1-87fd-efd1af484eda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.211.186.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T00:05:11.000Z",
      "valid_until": "2026-05-24T00:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-21T23:42:21.426Z",
      "x_nadsec_last_seen": "2026-04-21T23:50:04.755Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48524"
      ],
      "x_nadsec_orgs": [
        "INTERRA telecommunications group, Ltd."
      ]
    },
    {
      "created": "2026-04-22T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--3c0c1c94-8686-40e1-adc0-d4a0c9817fcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T00:05:11.000Z",
      "valid_until": "2026-05-24T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-21T23:20:48.212Z",
      "x_nadsec_last_seen": "2026-04-24T18:34:26.999Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-22T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TR; asn=9121; asn_org=Turk Telekom; user(top)=**",
      "id": "indicator--c251f775-8c84-414e-99bf-f9debd2ce86f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '78.186.122.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T00:05:11.000Z",
      "valid_until": "2026-05-24T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T23:07:23.981Z",
      "x_nadsec_last_seen": "2026-04-21T23:07:23.981Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-22T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--efa16785-05e8-4162-a92b-9709ebda2e11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T00:05:11.000Z",
      "valid_until": "2026-05-24T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T23:20:10.338Z",
      "x_nadsec_last_seen": "2026-04-21T23:20:10.338Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-22T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--8605893c-e581-4443-8f77-c48f0151cb51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T00:05:11.000Z",
      "valid_until": "2026-05-24T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T23:19:33.535Z",
      "x_nadsec_last_seen": "2026-04-21T23:19:33.535Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-22T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--41f34ec9-6f9e-4b41-a44f-47253b1d5703",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T00:05:11.000Z",
      "valid_until": "2026-05-24T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T23:20:00.127Z",
      "x_nadsec_last_seen": "2026-04-21T23:20:00.127Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-22T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d957bf72-50c3-4ac5-aa6c-939640ca3831",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T00:05:11.000Z",
      "valid_until": "2026-05-24T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-21T23:19:33.763Z",
      "x_nadsec_last_seen": "2026-04-21T23:19:33.763Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-22T02:05:46.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--57bfcdb2-c12b-4591-ae6f-978422d67588",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T02:05:46.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T02:05:46.000Z",
      "valid_until": "2026-05-24T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T01:15:30.055Z",
      "x_nadsec_last_seen": "2026-04-22T01:15:30.055Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-22T02:05:46.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--05077b0f-4178-4db5-88d4-7eba40036c45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T02:05:46.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T02:05:46.000Z",
      "valid_until": "2026-05-24T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T01:31:04.267Z",
      "x_nadsec_last_seen": "2026-04-22T01:31:04.267Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-22T02:05:46.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--da1e16d8-e380-4875-98fd-450c97e1714a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T02:05:46.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.15.162.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T02:05:46.000Z",
      "valid_until": "2026-05-24T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-22T01:37:56.100Z",
      "x_nadsec_last_seen": "2026-04-22T01:37:56.482Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-22T02:05:46.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b8537f52-1013-4bc6-8ce8-55ad477867d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T02:05:46.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.98.136.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T02:05:46.000Z",
      "valid_until": "2026-05-24T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-22T01:57:03.380Z",
      "x_nadsec_last_seen": "2026-04-22T01:57:04.078Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-22T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--d7a9fa4c-a302-4f1f-94c6-8ccb4d33a6b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T04:05:05.000Z",
      "valid_until": "2026-05-24T04:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-22T03:26:33.557Z",
      "x_nadsec_last_seen": "2026-04-27T14:33:38.374Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-22T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=httpd; ports=81; cc=US; asn=209847; asn_org=WorkTitans B.V.",
      "id": "indicator--6a26ad31-e11c-454a-9491-15495ebc8e33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '95.164.85.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T04:05:05.000Z",
      "valid_until": "2026-05-24T04:05:00.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-22T03:50:00.951Z",
      "x_nadsec_last_seen": "2026-04-22T03:50:45.432Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "209847"
      ],
      "x_nadsec_orgs": [
        "WorkTitans B.V."
      ]
    },
    {
      "created": "2026-04-22T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CH; asn=402253; asn_org=SKN Subnet & Telecom Ltd",
      "id": "indicator--835ae69f-a3dc-4482-b1fd-b9e2b6f6d4c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.251.181.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T05:05:11.000Z",
      "valid_until": "2026-05-24T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T04:20:04.458Z",
      "x_nadsec_last_seen": "2026-04-22T04:20:04.458Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "402253"
      ],
      "x_nadsec_orgs": [
        "SKN Subnet & Telecom Ltd"
      ]
    },
    {
      "created": "2026-04-22T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=epmapper; ports=135; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--f619a51d-806a-4632-b1d4-27df374f79e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '109.105.210.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T05:05:11.000Z",
      "valid_until": "2026-05-24T05:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-22T04:15:40.568Z",
      "x_nadsec_last_seen": "2026-04-22T04:17:08.654Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-04-22T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=epmapper; ports=135; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--958ea341-65c5-45e2-bbad-fd0bd9f63437",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '109.105.210.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T05:05:11.000Z",
      "valid_until": "2026-05-24T05:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-22T04:15:59.391Z",
      "x_nadsec_last_seen": "2026-04-22T04:16:52.120Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-04-22T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--65af9c6e-415e-43d5-83ed-ee2e8fdbec28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '109.105.210.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T05:05:11.000Z",
      "valid_until": "2026-05-24T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T04:16:06.568Z",
      "x_nadsec_last_seen": "2026-04-22T04:16:06.568Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-04-22T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--6dfabf19-0a36-4414-9d65-db148ff5f1a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.41.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T05:05:11.000Z",
      "valid_until": "2026-05-24T05:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-22T04:48:03.643Z",
      "x_nadsec_last_seen": "2026-04-22T04:48:48.805Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-22T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--6a8518b0-8f4b-4f47-8395-0c33e93d11b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.121.46.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T05:05:11.000Z",
      "valid_until": "2026-05-24T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-22T05:00:21.804Z",
      "x_nadsec_last_seen": "2026-04-22T05:00:32.198Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-22T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=CH; asn=402253; asn_org=SKN Subnet & Telecom Ltd",
      "id": "indicator--6f464778-0901-40f9-a286-932c92bcfb6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '209.99.184.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T05:05:11.000Z",
      "valid_until": "2026-05-24T05:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-22T04:20:44.591Z",
      "x_nadsec_last_seen": "2026-04-23T02:52:02.925Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "402253"
      ],
      "x_nadsec_orgs": [
        "SKN Subnet & Telecom Ltd"
      ]
    },
    {
      "created": "2026-04-22T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=VN; asn=131429; asn_org=MOBIFONE Corporation",
      "id": "indicator--d1935455-fa2c-4970-b8c3-5d2ee8df0d8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '42.1.67.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T05:05:11.000Z",
      "valid_until": "2026-05-24T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-22T04:55:33.717Z",
      "x_nadsec_last_seen": "2026-04-22T19:03:43.860Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "131429"
      ],
      "x_nadsec_orgs": [
        "MOBIFONE Corporation"
      ]
    },
    {
      "created": "2026-04-22T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--f97341dd-3f47-44ca-9a4b-1c5afa0a08cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T05:05:11.000Z",
      "valid_until": "2026-05-24T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T04:38:38.659Z",
      "x_nadsec_last_seen": "2026-04-22T04:38:38.659Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-22T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--47aedf4d-2771-4ed4-a843-8b8c0b6e6ad3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T05:05:11.000Z",
      "valid_until": "2026-05-24T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-22T04:52:42.605Z",
      "x_nadsec_last_seen": "2026-04-23T16:42:17.421Z",
      "x_nadsec_ports": [
        "1883",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-22T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--1c916567-7444-4033-a772-a5452e38839d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T05:05:11.000Z",
      "valid_until": "2026-05-24T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T04:38:39.336Z",
      "x_nadsec_last_seen": "2026-04-22T04:38:39.336Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-22T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--6c5dce6c-ed19-48f0-92b3-9a1367d426de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T05:05:11.000Z",
      "valid_until": "2026-05-24T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-22T04:52:42.398Z",
      "x_nadsec_last_seen": "2026-04-23T16:42:07.194Z",
      "x_nadsec_ports": [
        "1883",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-22T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=135905; asn_org=VIETNAM POSTS AND TELECOMMUNICATIONS GROUP",
      "id": "indicator--ecc06b25-b0f8-476c-986c-13a0659b82c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.225.213.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T06:05:10.000Z",
      "valid_until": "2026-05-24T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-22T05:29:54.836Z",
      "x_nadsec_last_seen": "2026-04-22T05:29:54.954Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "135905"
      ],
      "x_nadsec_orgs": [
        "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP"
      ]
    },
    {
      "created": "2026-04-22T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--a986bbfa-a5d7-4e06-9475-2f1e1542fa88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.235.123.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T06:05:10.000Z",
      "valid_until": "2026-05-24T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-22T05:25:56.876Z",
      "x_nadsec_last_seen": "2026-04-22T05:32:58.126Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-04-22T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=215540; asn_org=Global Connectivity Solutions Llp",
      "id": "indicator--9d28ec49-f032-4521-bddf-c4729ccd9ff8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.130.47.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T06:05:10.000Z",
      "valid_until": "2026-05-24T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T05:18:50.641Z",
      "x_nadsec_last_seen": "2026-04-22T05:18:50.641Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "215540"
      ],
      "x_nadsec_orgs": [
        "Global Connectivity Solutions Llp"
      ]
    },
    {
      "created": "2026-04-22T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--2478880a-5bdb-4352-8651-37eaf5d84486",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T06:05:10.000Z",
      "valid_until": "2026-05-24T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-09T17:17:52.663Z",
      "x_nadsec_last_seen": "2026-04-22T05:19:39.572Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-22T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=215540; asn_org=Global Connectivity Solutions Llp",
      "id": "indicator--d3c7caaf-535f-4b0f-8c81-540bd13b4a72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.130.47.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T07:05:11.000Z",
      "valid_until": "2026-05-24T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T06:51:03.312Z",
      "x_nadsec_last_seen": "2026-04-22T06:51:03.312Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "215540"
      ],
      "x_nadsec_orgs": [
        "Global Connectivity Solutions Llp"
      ]
    },
    {
      "created": "2026-04-22T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=28840; asn_org=Pjsc tattelecom",
      "id": "indicator--079bade5-4c4e-4828-9157-0d94cd0911c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.206.251.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T07:05:11.000Z",
      "valid_until": "2026-05-24T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-22T06:25:34.405Z",
      "x_nadsec_last_seen": "2026-04-22T06:30:14.407Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "28840"
      ],
      "x_nadsec_orgs": [
        "Pjsc tattelecom"
      ]
    },
    {
      "created": "2026-04-22T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--9b2cf059-0985-4656-83f3-bf3de9d8f5d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.11.129.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T07:05:11.000Z",
      "valid_until": "2026-05-24T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-22T06:42:53.241Z",
      "x_nadsec_last_seen": "2026-04-22T06:44:57.655Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-04-22T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--56973978-f5a2-4531-9a65-fcf2a2e4eb9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.46.226.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T07:05:11.000Z",
      "valid_until": "2026-05-24T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T07:00:42.488Z",
      "x_nadsec_last_seen": "2026-04-22T07:00:42.488Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-22T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--babd6f2f-71c5-48fd-b317-0e144e0e81a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T07:05:11.000Z",
      "valid_until": "2026-05-24T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T06:14:51.542Z",
      "x_nadsec_last_seen": "2026-04-22T06:14:51.542Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-22T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d02f7028-e9b4-491d-9aa8-ed2987a326f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.124.174.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T07:05:11.000Z",
      "valid_until": "2026-05-24T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T06:05:54.344Z",
      "x_nadsec_last_seen": "2026-04-22T06:05:54.344Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-22T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--700c2ab6-e6f1-46aa-9aa6-9cc0f2889487",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T07:05:11.000Z",
      "valid_until": "2026-05-24T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-22T06:32:46.032Z",
      "x_nadsec_last_seen": "2026-04-22T19:16:50.161Z",
      "x_nadsec_ports": [
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-22T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--1298de79-32e1-4bc1-804f-4d524406a09a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.193.33.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T08:05:11.000Z",
      "valid_until": "2026-05-24T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-22T07:09:11.424Z",
      "x_nadsec_last_seen": "2026-04-27T00:52:48.913Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-22T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--8a93e230-2a93-49da-84d0-30f26d38856a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '137.184.16.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T08:05:11.000Z",
      "valid_until": "2026-05-24T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T07:59:20.249Z",
      "x_nadsec_last_seen": "2026-04-22T07:59:20.249Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-22T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--ec6d6654-6b30-486f-8365-6012faf25a68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.216.254.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T08:05:11.000Z",
      "valid_until": "2026-05-24T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-22T07:49:05.562Z",
      "x_nadsec_last_seen": "2026-04-22T07:51:13.843Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-22T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--85230581-2fa2-4d23-8437-8384bdb7c3a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.241.39.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T08:05:11.000Z",
      "valid_until": "2026-05-24T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-22T07:40:02.255Z",
      "x_nadsec_last_seen": "2026-04-22T07:42:06.843Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-22T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=48479; asn_org=KUBAN-TELECOM Ltd.",
      "id": "indicator--1a39f927-77b7-4b47-8dcd-62ca170bd81e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.18.205.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T08:05:11.000Z",
      "valid_until": "2026-05-24T08:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-22T07:49:44.373Z",
      "x_nadsec_last_seen": "2026-04-22T07:51:49.339Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48479"
      ],
      "x_nadsec_orgs": [
        "KUBAN-TELECOM Ltd."
      ]
    },
    {
      "created": "2026-04-22T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--fa56facb-af44-4d84-ad06-41407925f623",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T08:05:11.000Z",
      "valid_until": "2026-05-24T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T07:31:27.872Z",
      "x_nadsec_last_seen": "2026-04-22T07:31:27.872Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-22T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--e3c548b3-3c84-4660-8d35-efa3c0aa03ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.20.250.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T09:05:12.000Z",
      "valid_until": "2026-05-24T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T08:44:20.420Z",
      "x_nadsec_last_seen": "2026-04-22T08:44:20.420Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-22T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TH; asn=23969; asn_org=TOT Public Company Limited; user(top)=**",
      "id": "indicator--2ff0bd76-bdbe-4e9e-97a9-d903a97fe037",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '101.109.163.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T09:05:12.000Z",
      "valid_until": "2026-05-24T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T08:44:19.822Z",
      "x_nadsec_last_seen": "2026-04-22T08:44:19.822Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-22T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LK; asn=9329; asn_org=Sri Lanka Telecom Internet",
      "id": "indicator--116f95ee-221c-4a0a-9eab-4db3909ff3ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '112.134.201.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T09:05:12.000Z",
      "valid_until": "2026-05-24T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-22T08:12:11.615Z",
      "x_nadsec_last_seen": "2026-04-22T08:14:18.045Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "9329"
      ],
      "x_nadsec_orgs": [
        "Sri Lanka Telecom Internet"
      ]
    },
    {
      "created": "2026-04-22T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--cd45bf33-823a-4eaa-b146-685423995ec5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.160.158.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T09:05:12.000Z",
      "valid_until": "2026-05-24T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-22T08:12:41.398Z",
      "x_nadsec_last_seen": "2026-04-22T08:14:45.932Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-22T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=209759; asn_org=Moy Telecom LLC",
      "id": "indicator--1c5e352c-49d6-419f-96e0-2f3fc50255bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.218.157.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T09:05:12.000Z",
      "valid_until": "2026-05-24T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-22T08:14:00.546Z",
      "x_nadsec_last_seen": "2026-04-22T08:21:29.583Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "209759"
      ],
      "x_nadsec_orgs": [
        "Moy Telecom LLC"
      ]
    },
    {
      "created": "2026-04-22T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--63610861-525e-42b0-95bf-028be96e0363",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.118.233.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T09:05:12.000Z",
      "valid_until": "2026-05-24T09:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-22T09:01:48.069Z",
      "x_nadsec_last_seen": "2026-04-22T09:01:58.245Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-22T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--16094e33-2657-4334-9039-03ee4f15fabf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.14.23.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T09:05:12.000Z",
      "valid_until": "2026-05-24T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T08:46:59.406Z",
      "x_nadsec_last_seen": "2026-04-22T08:46:59.406Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-22T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12714; asn_org=PJSC MegaFon",
      "id": "indicator--35e6f6f6-ada0-4561-b2c2-ef007e14fbe9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.72.236.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T09:05:12.000Z",
      "valid_until": "2026-05-24T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-22T08:50:07.693Z",
      "x_nadsec_last_seen": "2026-04-22T08:57:37.091Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12714"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-04-22T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--1bbc7d21-0bc0-49e5-b98e-84527962fc7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '51.8.107.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T09:05:12.000Z",
      "valid_until": "2026-05-24T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T08:18:21.350Z",
      "x_nadsec_last_seen": "2026-04-22T08:18:21.350Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-22T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=26077; asn_org=Nextlink Broadband",
      "id": "indicator--886ae124-2d36-41a6-88f6-03383b0f42e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '52.128.53.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T09:05:12.000Z",
      "valid_until": "2026-05-24T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-22T08:52:27.608Z",
      "x_nadsec_last_seen": "2026-04-22T08:54:33.702Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "26077"
      ],
      "x_nadsec_orgs": [
        "Nextlink Broadband"
      ]
    },
    {
      "created": "2026-04-22T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=NL; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--59f176b7-3775-4083-a141-13559a5c33d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.227.76.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T09:05:12.000Z",
      "valid_until": "2026-05-24T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T08:24:47.449Z",
      "x_nadsec_last_seen": "2026-04-22T08:24:47.449Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-22T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b754aaea-04a7-45f5-a807-297127266265",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.237.125.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T10:05:10.000Z",
      "valid_until": "2026-05-24T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-22T09:30:32.702Z",
      "x_nadsec_last_seen": "2026-04-22T09:30:33.550Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-22T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--294bc65d-065d-4ad5-a593-e542c638b4c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.168.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T10:05:10.000Z",
      "valid_until": "2026-05-24T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T09:51:51.366Z",
      "x_nadsec_last_seen": "2026-04-22T09:51:51.366Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-22T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=32475; asn_org=Internap Holding LLC",
      "id": "indicator--94596175-4e57-4e86-93bc-deffbc03efa5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '203.55.131.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T10:05:10.000Z",
      "valid_until": "2026-05-24T10:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-22T09:40:03.258Z",
      "x_nadsec_last_seen": "2026-04-28T15:51:12.068Z",
      "x_nadsec_ports": [
        "445",
        "81",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "httpd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "32475"
      ],
      "x_nadsec_orgs": [
        "Internap Holding LLC"
      ]
    },
    {
      "created": "2026-04-22T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=VN; asn=7602; asn_org=Sai gon Postel Corporation; user(top)=**",
      "id": "indicator--4dbf2de2-9238-45fb-bf44-c5ccea93ead8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '221.133.9.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T10:05:10.000Z",
      "valid_until": "2026-05-24T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T09:33:35.566Z",
      "x_nadsec_last_seen": "2026-04-22T09:33:35.566Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7602"
      ],
      "x_nadsec_orgs": [
        "Sai gon Postel Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-22T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--5b3c0f10-7832-449e-8050-c3bee9222203",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '125.22.42.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T11:05:10.000Z",
      "valid_until": "2026-05-24T11:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-22T10:16:21.459Z",
      "x_nadsec_last_seen": "2026-04-22T10:20:33.641Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-04-22T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=5573; asn_org=Rostelecom",
      "id": "indicator--b0883da9-23b2-4bde-84c9-ef9a1a4fe331",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.112.228.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T12:05:05.000Z",
      "valid_until": "2026-05-24T12:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-22T11:14:50.576Z",
      "x_nadsec_last_seen": "2026-04-22T11:14:50.619Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "5573"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-22T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=CH; asn=15169; asn_org=Google LLC",
      "id": "indicator--fed3a61e-8415-4737-a73c-0d7fd1f0d60b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.216.144.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T12:05:05.000Z",
      "valid_until": "2026-05-24T12:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-05T01:51:32.238Z",
      "x_nadsec_last_seen": "2026-04-22T11:48:05.086Z",
      "x_nadsec_ports": [
        "21",
        "445"
      ],
      "x_nadsec_services": [
        "ftpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "15169"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-22T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**",
      "id": "indicator--a314d22a-45d0-4000-bb5b-595a6c7bcd32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.65.21.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T13:05:05.000Z",
      "valid_until": "2026-05-24T13:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T12:49:43.879Z",
      "x_nadsec_last_seen": "2026-04-22T12:49:43.879Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-22T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=TJ; asn=51346; asn_org=Opened Joint Stock Company Tojiktelecom",
      "id": "indicator--21b6bf5b-316e-4a38-afb9-109cb173d02a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.177.2.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T13:05:05.000Z",
      "valid_until": "2026-05-24T13:05:03.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-04-22T12:38:42.510Z",
      "x_nadsec_last_seen": "2026-04-22T12:42:13.267Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TJ"
      ],
      "x_nadsec_asns": [
        "51346"
      ],
      "x_nadsec_orgs": [
        "Opened Joint Stock Company Tojiktelecom"
      ]
    },
    {
      "created": "2026-04-22T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--5f061e56-ad15-4211-ad69-9faddc28be47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.59.40.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T13:05:05.000Z",
      "valid_until": "2026-05-24T13:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-22T12:33:06.927Z",
      "x_nadsec_last_seen": "2026-04-22T12:38:51.847Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-22T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--04874bdc-25d2-4696-abea-1cd3c647c6b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T13:05:05.000Z",
      "valid_until": "2026-05-24T13:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T12:14:26.425Z",
      "x_nadsec_last_seen": "2026-04-22T12:14:26.425Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-22T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--6d896050-2f80-42d2-9b83-9c2d45372e65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '101.36.108.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T14:05:11.000Z",
      "valid_until": "2026-05-24T14:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-18T17:40:50.247Z",
      "x_nadsec_last_seen": "2026-04-22T13:35:20.333Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-22T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mqttd; ports=1883; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--59421a91-8aa0-4af6-b807-381e73d9cb3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '139.59.136.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T14:05:11.000Z",
      "valid_until": "2026-05-24T14:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-04-22T13:59:32.445Z",
      "x_nadsec_last_seen": "2026-04-22T13:59:37.674Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-22T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CO; asn=267777; asn_org=FUTURE SOLUTIONS DEVELOPMENT SAS; user(top)=**",
      "id": "indicator--be177006-69db-4087-b4da-17aaa3afd897",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.171.180.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T14:05:11.000Z",
      "valid_until": "2026-05-24T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T14:02:36.908Z",
      "x_nadsec_last_seen": "2026-04-22T14:02:36.908Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "267777"
      ],
      "x_nadsec_orgs": [
        "FUTURE SOLUTIONS DEVELOPMENT SAS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-22T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=NL; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--768a84d4-5019-4bc2-aeef-884be38ba87a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '93.174.95.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T14:05:11.000Z",
      "valid_until": "2026-05-24T14:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-22T13:59:47.117Z",
      "x_nadsec_last_seen": "2026-04-22T13:59:47.708Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-22T15:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--29f955f3-0808-4d87-a080-db0f2f2fc3f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T15:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.176.87.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T15:05:12.000Z",
      "valid_until": "2026-05-24T15:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-22T14:57:29.789Z",
      "x_nadsec_last_seen": "2026-04-22T14:59:35.029Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-04-22T15:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--67300d93-f65c-4e3e-a4d7-da0f732de70a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T15:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T15:05:12.000Z",
      "valid_until": "2026-05-24T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T14:52:25.899Z",
      "x_nadsec_last_seen": "2026-04-22T14:52:25.899Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-22T15:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--db745662-c3cd-43af-8105-90734aa135c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T15:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T15:05:12.000Z",
      "valid_until": "2026-05-24T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T14:52:26.421Z",
      "x_nadsec_last_seen": "2026-04-22T14:52:26.421Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-22T15:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--53ffec28-d4e2-49db-817e-af88c4650150",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T15:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T15:05:12.000Z",
      "valid_until": "2026-05-24T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T14:51:59.362Z",
      "x_nadsec_last_seen": "2026-04-22T14:51:59.362Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-22T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--2a1ced8d-58ee-4b85-9e5a-e45cad2c9cd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.172.26.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T17:05:03.000Z",
      "valid_until": "2026-05-24T17:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-22T16:55:29.649Z",
      "x_nadsec_last_seen": "2026-04-22T16:57:37.065Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-04-22T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--7b658355-6d92-4ec3-80d5-273f72381969",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T17:05:03.000Z",
      "valid_until": "2026-05-24T17:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T16:16:58.880Z",
      "x_nadsec_last_seen": "2026-04-22T16:16:58.880Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-22T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--1b7264d9-bc20-4d9b-bc52-19cc4b656da4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T17:05:03.000Z",
      "valid_until": "2026-05-24T17:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T16:16:58.378Z",
      "x_nadsec_last_seen": "2026-04-22T16:16:58.378Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-22T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--46da183e-7c1e-4b9f-a707-e5c165176016",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '218.1.141.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T17:05:03.000Z",
      "valid_until": "2026-05-24T17:05:00.000Z",
      "x_nadsec_event_count": 45,
      "x_nadsec_first_seen": "2026-04-22T16:13:44.563Z",
      "x_nadsec_last_seen": "2026-04-22T16:16:46.132Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-04-22T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--1f6973f5-1a49-4b02-b913-14611954a4b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T17:05:03.000Z",
      "valid_until": "2026-05-24T17:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T16:08:22.790Z",
      "x_nadsec_last_seen": "2026-04-22T16:08:22.790Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-22T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=pptpd; ports=1723; cc=DE; asn=212512; asn_org=Detai Prosperous Technologies Limited",
      "id": "indicator--b939fc4b-e0bd-4e48-96d8-6672675d0608",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T17:05:03.000Z",
      "valid_until": "2026-05-24T17:05:00.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-04-22T16:54:42.884Z",
      "x_nadsec_last_seen": "2026-04-23T06:57:48.949Z",
      "x_nadsec_ports": [
        "445",
        "1723"
      ],
      "x_nadsec_services": [
        "smbd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "212512"
      ],
      "x_nadsec_orgs": [
        "Detai Prosperous Technologies Limited"
      ]
    },
    {
      "created": "2026-04-22T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--6f8644d4-71a0-4f1a-ac6b-9971fe076fd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T17:05:03.000Z",
      "valid_until": "2026-05-24T17:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T16:54:25.542Z",
      "x_nadsec_last_seen": "2026-04-22T16:54:25.542Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-22T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--2ddcb891-07cc-4651-8e71-ca64dbe78143",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T17:05:03.000Z",
      "valid_until": "2026-05-24T17:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-22T16:04:33.310Z",
      "x_nadsec_last_seen": "2026-04-22T16:09:06.694Z",
      "x_nadsec_ports": [
        "42",
        "135",
        "43343"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-22T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--9808a718-3ab9-4c42-b6b3-aee79e2e0be3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T17:05:03.000Z",
      "valid_until": "2026-05-24T17:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T19:59:00.393Z",
      "x_nadsec_last_seen": "2026-04-22T16:16:16.351Z",
      "x_nadsec_ports": [
        "445",
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-22T20:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e7d39e25-f8c3-423c-8b98-09e40647db29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T20:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '137.184.105.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T20:05:15.000Z",
      "valid_until": "2026-05-24T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T19:37:16.798Z",
      "x_nadsec_last_seen": "2026-04-22T19:37:16.798Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-22T20:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=SG; asn=9009; asn_org=M247 Europe SRL; user(top)=r**t",
      "id": "indicator--0577524d-9062-4fbe-82e2-0eb6a97851e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T20:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.199.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T20:05:15.000Z",
      "valid_until": "2026-05-24T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T19:55:15.646Z",
      "x_nadsec_last_seen": "2026-04-22T19:55:15.646Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "9009"
      ],
      "x_nadsec_orgs": [
        "M247 Europe SRL"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-22T20:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=PH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--ff1a5186-2954-4f0c-a96a-4a5ea7939e70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T20:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.58.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T20:05:15.000Z",
      "valid_until": "2026-05-24T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-22T19:41:24.125Z",
      "x_nadsec_last_seen": "2026-04-22T19:41:43.718Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-22T20:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--2eb7534f-3361-440b-af44-48157a5021db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T20:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T20:05:15.000Z",
      "valid_until": "2026-05-24T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T19:26:12.680Z",
      "x_nadsec_last_seen": "2026-04-22T19:26:12.680Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-22T20:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--7e516953-c8b8-40a7-9479-ed32166b3f5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T20:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.101.224.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T20:05:15.000Z",
      "valid_until": "2026-05-24T20:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-22T19:26:12.626Z",
      "x_nadsec_last_seen": "2026-04-22T19:26:24.430Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-22T21:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IQ; asn=203214; asn_org=Hulum Almustakbal Company for Communication Engineering and Services Ltd; user(top)=**",
      "id": "indicator--656d2713-5f73-4fbb-ab14-4afce75e01df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T21:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '109.224.17.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T21:05:04.000Z",
      "valid_until": "2026-05-24T21:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T20:25:29.671Z",
      "x_nadsec_last_seen": "2026-04-22T20:25:29.671Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IQ"
      ],
      "x_nadsec_asns": [
        "203214"
      ],
      "x_nadsec_orgs": [
        "Hulum Almustakbal Company for Communication Engineering and Services Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-22T21:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--84c5e6b7-f727-45dd-8f2a-3cb0c3a38972",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T21:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T21:05:04.000Z",
      "valid_until": "2026-05-24T21:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T20:52:40.821Z",
      "x_nadsec_last_seen": "2026-04-22T20:52:40.821Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-22T21:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e49c5a33-8596-4bcd-b9db-d2661a81161d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T21:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.163.15.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T21:05:04.000Z",
      "valid_until": "2026-05-24T21:05:02.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-22T20:47:30.355Z",
      "x_nadsec_last_seen": "2026-04-22T20:47:30.941Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-22T21:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d24e4c72-269d-4049-b23c-c2a9d9bb2e80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T21:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T21:05:04.000Z",
      "valid_until": "2026-05-24T21:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T20:58:30.667Z",
      "x_nadsec_last_seen": "2026-04-22T20:58:30.667Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-22T21:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--88a78e83-8360-4a01-8b45-0936ac36405b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T21:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T21:05:04.000Z",
      "valid_until": "2026-05-24T21:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T20:58:41.018Z",
      "x_nadsec_last_seen": "2026-04-22T20:58:41.018Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-22T21:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=NL; asn=202412; asn_org=Omegatech LTD",
      "id": "indicator--993282f7-93c5-468d-8af7-cb70c27acf0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T21:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.154.35.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T21:05:04.000Z",
      "valid_until": "2026-05-24T21:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-22T20:21:23.928Z",
      "x_nadsec_last_seen": "2026-04-24T04:30:15.000Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ]
    },
    {
      "created": "2026-04-22T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--f29c8ce8-e001-48fa-8e85-8f706e872561",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T22:05:11.000Z",
      "valid_until": "2026-05-24T22:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-22T21:52:54.825Z",
      "x_nadsec_last_seen": "2026-04-22T21:52:54.825Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-04-22T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0afcf427-ba43-4457-8a8c-00d5cf35a78d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '192.241.248.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T22:05:11.000Z",
      "valid_until": "2026-05-24T22:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-22T21:46:56.768Z",
      "x_nadsec_last_seen": "2026-04-30T22:45:39.023Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-22T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--3e449657-f615-4042-b4a2-ce840092a748",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '71.6.165.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T22:05:11.000Z",
      "valid_until": "2026-05-24T22:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-22T21:53:05.303Z",
      "x_nadsec_last_seen": "2026-04-26T21:28:10.036Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-04-22T23:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=MX; asn=13999; asn_org=Mega Cable, S.A. de C.V.",
      "id": "indicator--60d15f53-ef39-4bd7-83ed-cff87325b86f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T23:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '177.230.140.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T23:05:12.000Z",
      "valid_until": "2026-05-24T23:05:08.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-04-22T22:37:49.471Z",
      "x_nadsec_last_seen": "2026-04-22T22:40:29.907Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "13999"
      ],
      "x_nadsec_orgs": [
        "Mega Cable, S.A. de C.V."
      ]
    },
    {
      "created": "2026-04-22T23:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--136e843d-0f4d-4999-b489-a05241d2ae56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T23:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.9.33.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T23:05:12.000Z",
      "valid_until": "2026-05-24T23:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-22T22:07:37.751Z",
      "x_nadsec_last_seen": "2026-04-22T22:07:42.136Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-04-23T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--22dc1e87-f999-4699-aff7-b175aa48187d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.144.170.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T00:05:02.000Z",
      "valid_until": "2026-05-25T00:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-22T23:46:23.609Z",
      "x_nadsec_last_seen": "2026-04-22T23:53:08.718Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-04-23T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--ffafaa18-14bd-4c40-a135-08974301211b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T00:05:02.000Z",
      "valid_until": "2026-05-25T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-22T23:19:10.657Z",
      "x_nadsec_last_seen": "2026-04-25T07:34:05.814Z",
      "x_nadsec_ports": [
        "1433",
        "27017"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-23T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--302f20ec-5469-471f-b805-1adb9688edf0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.130.7.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T00:05:02.000Z",
      "valid_until": "2026-05-25T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-22T23:24:40.213Z",
      "x_nadsec_last_seen": "2026-04-22T23:24:40.265Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-04-23T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC; user(top)=a*******s; pass(top)=a********@",
      "id": "indicator--6e8df8cd-937f-4537-92c7-7d3cb5e4f32c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.205.167.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T00:05:02.000Z",
      "valid_until": "2026-05-25T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-23T00:03:03.356Z",
      "x_nadsec_last_seen": "2026-04-23T00:03:03.871Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-04-23T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--28df02d4-73c6-4717-805a-cfb518838ac8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '162.216.150.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T01:05:03.000Z",
      "valid_until": "2026-05-25T01:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T00:38:17.549Z",
      "x_nadsec_last_seen": "2026-04-23T00:38:17.549Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-23T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--59829283-0de4-46b4-92d7-f834e531dd06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T01:05:03.000Z",
      "valid_until": "2026-05-25T01:05:02.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-23T00:58:38.140Z",
      "x_nadsec_last_seen": "2026-04-23T00:58:38.482Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-23T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=28126; asn_org=BRISANET SERVICOS DE TELECOMUNICACOES S.A; user(top)=**",
      "id": "indicator--5f8de5ac-496e-418f-9e1d-a4fb464d965f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '206.42.55.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T01:05:03.000Z",
      "valid_until": "2026-05-25T01:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T00:53:14.246Z",
      "x_nadsec_last_seen": "2026-04-23T00:53:14.246Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28126"
      ],
      "x_nadsec_orgs": [
        "BRISANET SERVICOS DE TELECOMUNICACOES S.A"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-23T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--91a4fca3-234c-4cf3-b41d-8cfce513977a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.84.4.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T01:05:03.000Z",
      "valid_until": "2026-05-25T01:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T00:54:16.991Z",
      "x_nadsec_last_seen": "2026-04-23T00:54:16.991Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-23T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=GB; asn=42831; asn_org=UK Dedicated Servers Limited; user(top)=**; pass(top)=1****6",
      "id": "indicator--901c44f0-81df-4025-aa2a-1ffbef73179b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '78.110.164.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T01:05:03.000Z",
      "valid_until": "2026-05-25T01:05:02.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-20T20:46:54.290Z",
      "x_nadsec_last_seen": "2026-04-23T00:13:43.812Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "42831"
      ],
      "x_nadsec_orgs": [
        "UK Dedicated Servers Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "",
        "1****6"
      ]
    },
    {
      "created": "2026-04-23T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=IN; asn=59165; asn_org=Auspice Infratel Pvt. Ltd.; user(top)=**; pass(top)=0**2",
      "id": "indicator--bbe4bc95-f3cd-4d5f-a044-da570ed761e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.204.52.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T02:05:10.000Z",
      "valid_until": "2026-05-25T02:05:08.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-04-23T01:10:56.507Z",
      "x_nadsec_last_seen": "2026-04-23T01:11:04.078Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "59165"
      ],
      "x_nadsec_orgs": [
        "Auspice Infratel Pvt. Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "0**2"
      ]
    },
    {
      "created": "2026-04-23T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--d58fe13c-3414-48a0-a008-f0b34a5f256b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '115.74.194.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T02:05:10.000Z",
      "valid_until": "2026-05-25T02:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-23T01:37:41.492Z",
      "x_nadsec_last_seen": "2026-04-23T01:39:46.542Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-23T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--21db0c1d-56f4-4202-83f1-4fc7b7d3c8c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.83.125.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T02:05:10.000Z",
      "valid_until": "2026-05-25T02:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-23T01:52:02.481Z",
      "x_nadsec_last_seen": "2026-04-23T01:58:34.197Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-23T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--64f24033-d704-4c92-88a5-f570752b69ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '61.95.183.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T02:05:10.000Z",
      "valid_until": "2026-05-25T02:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-23T01:21:10.318Z",
      "x_nadsec_last_seen": "2026-04-23T01:23:14.882Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-04-23T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=141137; asn_org=PT Media Cepat Indonesia",
      "id": "indicator--825293ee-d7c6-4367-8633-92dae6f7c75a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.158.253.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T03:05:10.000Z",
      "valid_until": "2026-05-25T03:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-23T02:53:00.000Z",
      "x_nadsec_last_seen": "2026-04-23T02:55:05.347Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "141137"
      ],
      "x_nadsec_orgs": [
        "PT Media Cepat Indonesia"
      ]
    },
    {
      "created": "2026-04-23T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=12; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--31bf4343-d0da-43fe-8ba2-e482672bea6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '119.51.197.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T03:05:10.000Z",
      "valid_until": "2026-05-25T03:05:08.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-04-23T02:40:36.202Z",
      "x_nadsec_last_seen": "2026-04-23T02:40:45.255Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6"
      ]
    },
    {
      "created": "2026-04-23T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--2888a66c-71e8-49d4-8ad5-dff546010227",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T03:05:10.000Z",
      "valid_until": "2026-05-25T03:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-23T02:37:40.863Z",
      "x_nadsec_last_seen": "2026-04-23T02:37:41.659Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-23T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--3482b64c-6087-481b-a213-7abd33417a4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '181.115.171.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T03:05:10.000Z",
      "valid_until": "2026-05-25T03:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-23T02:46:27.162Z",
      "x_nadsec_last_seen": "2026-04-23T02:48:33.293Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-04-23T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=SV; asn=14754; asn_org=TELECOMUNICACIONES DE GUATEMALA, SOCIEDAD ANONIMA; user(top)=**",
      "id": "indicator--eac513e9-1ffc-4f8e-8b9e-0bf7b081b02d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.86.199.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T03:05:10.000Z",
      "valid_until": "2026-05-25T03:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T03:02:08.937Z",
      "x_nadsec_last_seen": "2026-04-23T03:02:08.937Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SV"
      ],
      "x_nadsec_asns": [
        "14754"
      ],
      "x_nadsec_orgs": [
        "TELECOMUNICACIONES DE GUATEMALA, SOCIEDAD ANONIMA"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-23T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=CH; asn=402253; asn_org=SKN Subnet & Telecom Ltd",
      "id": "indicator--10042647-85ba-481b-8b15-aa26e3a33891",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '209.99.189.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T03:05:10.000Z",
      "valid_until": "2026-05-25T03:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-23T02:52:04.105Z",
      "x_nadsec_last_seen": "2026-04-23T02:52:04.121Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "402253"
      ],
      "x_nadsec_orgs": [
        "SKN Subnet & Telecom Ltd"
      ]
    },
    {
      "created": "2026-04-23T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--90663719-1e28-46aa-8e0a-ffc2462ed70f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.84.103.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T03:05:10.000Z",
      "valid_until": "2026-05-25T03:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-01T06:55:52.369Z",
      "x_nadsec_last_seen": "2026-04-23T02:15:48.490Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-23T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--fd72bdaa-f2f0-4f78-8981-62762a7eda76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.95.183.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T03:05:10.000Z",
      "valid_until": "2026-05-25T03:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-23T02:38:27.499Z",
      "x_nadsec_last_seen": "2026-04-23T03:00:03.796Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-23T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--da587325-269f-4116-8f7b-75281b560267",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T04:05:10.000Z",
      "valid_until": "2026-05-25T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T03:12:18.704Z",
      "x_nadsec_last_seen": "2026-04-23T03:12:18.704Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-23T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--050a5304-0715-4091-9e48-b6d2b33abcaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T04:05:10.000Z",
      "valid_until": "2026-05-25T04:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-23T03:10:37.675Z",
      "x_nadsec_last_seen": "2026-04-23T03:18:54.615Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-04-23T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CH; asn=402253; asn_org=SKN Subnet & Telecom Ltd",
      "id": "indicator--34c84b27-94f6-43d5-ac02-8adec35dfc6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '209.99.184.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T04:05:10.000Z",
      "valid_until": "2026-05-25T04:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-23T04:04:18.833Z",
      "x_nadsec_last_seen": "2026-04-23T04:05:02.317Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "402253"
      ],
      "x_nadsec_orgs": [
        "SKN Subnet & Telecom Ltd"
      ]
    },
    {
      "created": "2026-04-23T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=pptpd; ports=1723; cc=CH; asn=402253; asn_org=SKN Subnet & Telecom Ltd",
      "id": "indicator--2db5b13a-d1bc-41a8-a107-600d541a857b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '209.99.186.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T04:05:10.000Z",
      "valid_until": "2026-05-25T04:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-23T04:02:49.437Z",
      "x_nadsec_last_seen": "2026-04-23T04:03:04.776Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "402253"
      ],
      "x_nadsec_orgs": [
        "SKN Subnet & Telecom Ltd"
      ]
    },
    {
      "created": "2026-04-23T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=mssqld; ports=1433; cc=CH; asn=402253; asn_org=SKN Subnet & Telecom Ltd",
      "id": "indicator--8945d59e-b1ba-401a-8a46-931b8b44fded",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '209.99.190.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T04:05:10.000Z",
      "valid_until": "2026-05-25T04:05:08.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-04-23T03:47:24.427Z",
      "x_nadsec_last_seen": "2026-04-23T04:12:13.862Z",
      "x_nadsec_ports": [
        "135",
        "1433",
        "1883",
        "21"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mssqld",
        "mqttd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "402253"
      ],
      "x_nadsec_orgs": [
        "SKN Subnet & Telecom Ltd"
      ]
    },
    {
      "created": "2026-04-23T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--b3a83eb0-9806-48fe-a105-d3174081ced8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '212.220.110.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T04:05:10.000Z",
      "valid_until": "2026-05-25T04:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-23T03:12:24.469Z",
      "x_nadsec_last_seen": "2026-04-23T03:14:31.178Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-23T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom; user(top)=**",
      "id": "indicator--45e636d5-1e8b-4cf0-acc5-3838a673a261",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '82.200.154.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T04:05:10.000Z",
      "valid_until": "2026-05-25T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T03:09:04.574Z",
      "x_nadsec_last_seen": "2026-04-23T03:09:04.574Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-23T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--dcdb0c5c-585c-4238-8be4-98c79aaea9c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T04:05:10.000Z",
      "valid_until": "2026-05-25T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T03:15:10.990Z",
      "x_nadsec_last_seen": "2026-04-23T03:15:10.990Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-23T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--1a484150-637b-4687-b838-66c828c6da96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T04:05:10.000Z",
      "valid_until": "2026-05-25T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T03:15:10.645Z",
      "x_nadsec_last_seen": "2026-04-23T03:15:10.645Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-23T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=PA; asn=64107; asn_org=RACK SPHERE HOSTING S.A.",
      "id": "indicator--20a0a4a5-3219-4947-abe4-af9ee7800c8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.225.135.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T05:05:02.000Z",
      "valid_until": "2026-05-25T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T04:10:30.414Z",
      "x_nadsec_last_seen": "2026-04-23T04:10:30.414Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "PA"
      ],
      "x_nadsec_asns": [
        "64107"
      ],
      "x_nadsec_orgs": [
        "RACK SPHERE HOSTING S.A."
      ]
    },
    {
      "created": "2026-04-23T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--3e77ed7f-1527-40b0-ac92-2a8556e0fa36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T05:05:02.000Z",
      "valid_until": "2026-05-25T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T05:03:55.626Z",
      "x_nadsec_last_seen": "2026-04-23T05:03:55.626Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-23T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TW; asn=38841; asn_org=kbro CO. Ltd.",
      "id": "indicator--7327ea47-8ed5-4595-ab0a-9bc0bced895a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '106.1.226.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T06:05:03.000Z",
      "valid_until": "2026-05-25T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-23T06:01:22.971Z",
      "x_nadsec_last_seen": "2026-04-23T06:03:27.803Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "38841"
      ],
      "x_nadsec_orgs": [
        "kbro CO. Ltd."
      ]
    },
    {
      "created": "2026-04-23T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--ac91d11a-d37d-486d-a05e-8ccc4335b102",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.241.40.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T06:05:03.000Z",
      "valid_until": "2026-05-25T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-23T05:19:46.980Z",
      "x_nadsec_last_seen": "2026-04-23T05:19:51.989Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-23T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--9b06eff6-ea7b-4326-a794-5166287b50cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.36.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T06:05:03.000Z",
      "valid_until": "2026-05-25T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T05:23:12.728Z",
      "x_nadsec_last_seen": "2026-04-23T05:23:12.728Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-23T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--1a13c98f-79dd-4f6e-a388-ab0457add13b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '171.244.23.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T06:05:03.000Z",
      "valid_until": "2026-05-25T06:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-23T05:16:11.896Z",
      "x_nadsec_last_seen": "2026-04-23T05:22:33.605Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-23T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--91826699-cca4-43af-a7e2-7591b55cb5b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.14.78.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T06:05:03.000Z",
      "valid_until": "2026-05-25T06:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-23T05:35:29.290Z",
      "x_nadsec_last_seen": "2026-04-23T05:35:39.433Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-23T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=46; services=smbd; ports=445; cc=PK; asn=55501; asn_org=141-143 Maulana Shaukat Ali Road",
      "id": "indicator--cfaaa9b2-fa51-4c87-b41f-a2d9cafdd63d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '202.166.161.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T06:05:03.000Z",
      "valid_until": "2026-05-25T06:05:01.000Z",
      "x_nadsec_event_count": 46,
      "x_nadsec_first_seen": "2026-04-23T06:01:25.565Z",
      "x_nadsec_last_seen": "2026-04-23T06:04:36.892Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "55501"
      ],
      "x_nadsec_orgs": [
        "141-143 Maulana Shaukat Ali Road"
      ]
    },
    {
      "created": "2026-04-23T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=17665; asn_org=ONEOTT INTERTAINMENT LIMITED",
      "id": "indicator--062d6354-d8ce-4270-af7f-46b24fd38150",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '203.192.227.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T06:05:03.000Z",
      "valid_until": "2026-05-25T06:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-23T05:48:01.685Z",
      "x_nadsec_last_seen": "2026-04-23T05:55:16.929Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17665"
      ],
      "x_nadsec_orgs": [
        "ONEOTT INTERTAINMENT LIMITED"
      ]
    },
    {
      "created": "2026-04-23T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=135715; asn_org=INet Services Pvt Ltd",
      "id": "indicator--edbb078e-e510-43e0-b466-973aef5d94ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.134.111.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T07:05:10.000Z",
      "valid_until": "2026-05-25T07:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-23T06:36:42.666Z",
      "x_nadsec_last_seen": "2026-04-23T06:38:47.419Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135715"
      ],
      "x_nadsec_orgs": [
        "INet Services Pvt Ltd"
      ]
    },
    {
      "created": "2026-04-23T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--c3a3b5d1-cbeb-4c40-9167-ad903338713f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.182.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T07:05:10.000Z",
      "valid_until": "2026-05-25T07:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T06:50:35.986Z",
      "x_nadsec_last_seen": "2026-04-23T06:50:35.986Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-23T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--39bd993b-19f7-4f19-8e47-36e4ea285c42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.115.90.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T07:05:10.000Z",
      "valid_until": "2026-05-25T07:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-23T06:42:57.494Z",
      "x_nadsec_last_seen": "2026-04-23T06:43:07.761Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-23T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--eef12f5d-134e-44ff-9ac5-3d192310d033",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.38.143.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T07:05:10.000Z",
      "valid_until": "2026-05-25T07:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T06:31:20.155Z",
      "x_nadsec_last_seen": "2026-04-23T06:31:20.155Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-23T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--9c5f07fa-0d51-46a0-b64c-28c147fcbd0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.38.83.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T07:05:10.000Z",
      "valid_until": "2026-05-25T07:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T06:31:54.191Z",
      "x_nadsec_last_seen": "2026-04-23T06:31:54.191Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-23T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BY; asn=6697; asn_org=Republican Unitary Telecommunication Enterprise Beltelecom",
      "id": "indicator--314b6634-462b-42c6-b9f5-2bafb2502125",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.212.55.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T07:05:10.000Z",
      "valid_until": "2026-05-25T07:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-23T06:28:14.399Z",
      "x_nadsec_last_seen": "2026-04-23T06:35:11.215Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BY"
      ],
      "x_nadsec_asns": [
        "6697"
      ],
      "x_nadsec_orgs": [
        "Republican Unitary Telecommunication Enterprise Beltelecom"
      ]
    },
    {
      "created": "2026-04-23T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8b552010-1b64-44a2-a8b6-61719bab0833",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T07:05:10.000Z",
      "valid_until": "2026-05-25T07:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T06:34:46.333Z",
      "x_nadsec_last_seen": "2026-04-23T06:34:46.333Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-23T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--09a53c20-8cef-4ef7-a2aa-2d8d18ad0268",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '106.219.90.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T08:05:02.000Z",
      "valid_until": "2026-05-25T08:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-23T07:36:43.820Z",
      "x_nadsec_last_seen": "2026-04-23T07:44:00.549Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-04-23T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=httpd; ports=81; cc=AE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--8a26bfd0-f704-4ccd-883a-7c71ae84955c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.12.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T08:05:02.000Z",
      "valid_until": "2026-05-25T08:05:01.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-04-16T18:43:59.485Z",
      "x_nadsec_last_seen": "2026-04-23T07:57:22.559Z",
      "x_nadsec_ports": [
        "81",
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "httpd",
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-23T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--cc38184a-cf91-4be7-8e06-afcb40f30217",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.22.35.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T08:05:02.000Z",
      "valid_until": "2026-05-25T08:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T07:31:25.460Z",
      "x_nadsec_last_seen": "2026-04-23T07:31:25.460Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-23T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--e7e76dc7-6a70-4441-b5ff-f57aa1249b81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.237.33.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T08:05:02.000Z",
      "valid_until": "2026-05-25T08:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-23T07:32:38.207Z",
      "x_nadsec_last_seen": "2026-04-23T07:32:38.541Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-23T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--ca07831a-ebff-4518-acfa-9954d1e10360",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T08:05:02.000Z",
      "valid_until": "2026-05-25T08:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-23T08:01:12.658Z",
      "x_nadsec_last_seen": "2026-04-24T01:34:59.882Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-23T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--001f3138-e708-4563-a656-1a5867c29331",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T08:05:02.000Z",
      "valid_until": "2026-05-25T08:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T07:32:43.745Z",
      "x_nadsec_last_seen": "2026-04-23T07:32:43.745Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-23T09:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--8cc6fae6-5ee5-4fbc-b60e-31d0e9a8117d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T09:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.57.236.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T09:05:01.000Z",
      "valid_until": "2026-05-25T09:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-23T08:56:54.005Z",
      "x_nadsec_last_seen": "2026-04-23T09:03:33.565Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-04-23T09:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--c253af42-2a8c-4c63-82d9-827ad3ae67c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T09:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T09:05:01.000Z",
      "valid_until": "2026-05-25T09:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T08:29:41.980Z",
      "x_nadsec_last_seen": "2026-04-23T08:29:41.980Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-23T09:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--614e381f-ddae-4fda-a185-74ff1d965e49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T09:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T09:05:01.000Z",
      "valid_until": "2026-05-25T09:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T08:24:20.739Z",
      "x_nadsec_last_seen": "2026-04-23T08:24:20.739Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-23T10:07:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--18e54645-e7dd-45f8-866e-eee000be2e63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T10:07:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.131.2.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T10:07:32.000Z",
      "valid_until": "2026-05-25T10:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T09:21:27.998Z",
      "x_nadsec_last_seen": "2026-04-23T09:21:27.998Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-23T10:07:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--7a6535fc-5488-4288-837e-e7d60c64b336",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T10:07:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.163.158.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T10:07:32.000Z",
      "valid_until": "2026-05-25T10:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-23T09:37:29.990Z",
      "x_nadsec_last_seen": "2026-04-23T09:39:35.986Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-23T10:07:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--2a8a7f5d-2de2-4362-b1d0-b05125b65b8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T10:07:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.198.47.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T10:07:32.000Z",
      "valid_until": "2026-05-25T10:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T09:51:27.689Z",
      "x_nadsec_last_seen": "2026-04-23T09:51:27.689Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-23T10:07:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--9743d745-049c-470b-85e5-1248046b747f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T10:07:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.163.15.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T10:07:32.000Z",
      "valid_until": "2026-05-25T10:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T09:32:42.641Z",
      "x_nadsec_last_seen": "2026-04-23T09:32:42.641Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-23T10:07:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d095ba62-ac56-476c-8692-62aa57a1fcfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T10:07:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '52.165.89.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T10:07:32.000Z",
      "valid_until": "2026-05-25T10:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-23T09:39:16.563Z",
      "x_nadsec_last_seen": "2026-04-23T09:39:16.912Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-23T10:07:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--c3927bec-00ce-4e53-8bda-87dddf4e75ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T10:07:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T10:07:32.000Z",
      "valid_until": "2026-05-25T10:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T09:08:35.292Z",
      "x_nadsec_last_seen": "2026-04-23T09:08:35.292Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-23T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=151690; asn_org=FAB FIVE NETWORK PRIVATE LIMITED",
      "id": "indicator--c12b58a5-0aed-446f-afb1-23d83052da88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.109.221.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T11:05:11.000Z",
      "valid_until": "2026-05-25T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-23T10:22:03.094Z",
      "x_nadsec_last_seen": "2026-04-23T10:24:09.846Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "151690"
      ],
      "x_nadsec_orgs": [
        "FAB FIVE NETWORK PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-04-23T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=pptpd; ports=1723; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--7fe6b9a2-7584-4c82-9f59-7d69aeb9c48d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '134.122.45.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T11:05:11.000Z",
      "valid_until": "2026-05-25T11:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-04-23T10:21:48.542Z",
      "x_nadsec_last_seen": "2026-04-23T10:26:37.206Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017",
        "35387"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-23T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=UA; asn=43047; asn_org=Stream-Network Ltd.",
      "id": "indicator--49faecb5-9757-44a8-bbd3-dc35283ae1be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.120.225.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T11:05:11.000Z",
      "valid_until": "2026-05-25T11:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-23T10:43:34.665Z",
      "x_nadsec_last_seen": "2026-04-23T10:43:34.827Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "43047"
      ],
      "x_nadsec_orgs": [
        "Stream-Network Ltd."
      ]
    },
    {
      "created": "2026-04-23T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--7233510e-7e89-460a-bcc3-529b3d8ebdda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.188.179.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T11:05:11.000Z",
      "valid_until": "2026-05-25T11:05:09.000Z",
      "x_nadsec_event_count": 3148,
      "x_nadsec_first_seen": "2026-04-23T10:48:47.516Z",
      "x_nadsec_last_seen": "2026-04-23T13:10:09.474Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-04-23T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--fe064278-9b7f-455a-a97e-bd72727fae20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '39.56.32.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T11:05:11.000Z",
      "valid_until": "2026-05-25T11:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-23T10:15:06.323Z",
      "x_nadsec_last_seen": "2026-04-23T10:22:41.008Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-04-23T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--cc628057-cf6c-441d-b184-a05a0e800779",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '58.65.211.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T11:05:11.000Z",
      "valid_until": "2026-05-25T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-23T10:14:36.162Z",
      "x_nadsec_last_seen": "2026-04-23T10:16:43.234Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ]
    },
    {
      "created": "2026-04-23T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--82959108-44b9-45b9-9aad-cd90118869a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '168.144.86.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T12:05:10.000Z",
      "valid_until": "2026-05-25T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T11:14:15.926Z",
      "x_nadsec_last_seen": "2026-04-23T11:14:15.926Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-23T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--5dc0c3d0-e024-4f84-88fe-336b84134203",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.155.105.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T13:05:10.000Z",
      "valid_until": "2026-05-25T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T12:15:55.386Z",
      "x_nadsec_last_seen": "2026-04-23T12:15:55.386Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-23T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--30fae17b-96a6-4374-b500-ee31b7c3b45d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '156.204.112.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T13:05:10.000Z",
      "valid_until": "2026-05-25T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-23T12:29:41.067Z",
      "x_nadsec_last_seen": "2026-04-23T12:29:47.554Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-23T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=151185; asn_org=China Telecom; user(top)=**",
      "id": "indicator--5c260525-1a11-415f-942f-bbb3a0c0dfe7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '171.80.15.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T13:05:10.000Z",
      "valid_until": "2026-05-25T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T12:50:54.757Z",
      "x_nadsec_last_seen": "2026-04-23T12:50:54.757Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "151185"
      ],
      "x_nadsec_orgs": [
        "China Telecom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-23T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--56c03186-8669-4d4f-9209-1998613e2a30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.202.104.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T13:05:10.000Z",
      "valid_until": "2026-05-25T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T12:37:01.357Z",
      "x_nadsec_last_seen": "2026-04-23T12:37:01.357Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-23T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MU; asn=30844; asn_org=Liquid Telecommunications Ltd",
      "id": "indicator--cd61a957-d4b6-42f6-9328-19ade48de934",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.201.231.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T13:05:10.000Z",
      "valid_until": "2026-05-25T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-23T12:24:13.653Z",
      "x_nadsec_last_seen": "2026-04-23T12:26:21.440Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MU"
      ],
      "x_nadsec_asns": [
        "30844"
      ],
      "x_nadsec_orgs": [
        "Liquid Telecommunications Ltd"
      ]
    },
    {
      "created": "2026-04-23T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--7d79fad6-3b04-4afe-a645-744b0e78b15b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.163.60.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T13:05:10.000Z",
      "valid_until": "2026-05-25T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T13:04:36.670Z",
      "x_nadsec_last_seen": "2026-04-23T13:04:36.670Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-23T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c1c29843-6920-402e-b020-aff80b1cb14b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.98.164.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T13:05:10.000Z",
      "valid_until": "2026-05-25T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-23T12:31:52.778Z",
      "x_nadsec_last_seen": "2026-04-23T12:32:03.128Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-23T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=RU; asn=16143; asn_org=OOO NIIR-RadioNet; user(top)=**",
      "id": "indicator--f342f73a-f217-4bf0-b841-d69ad407b78b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '217.76.44.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T13:05:10.000Z",
      "valid_until": "2026-05-25T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T12:53:40.780Z",
      "x_nadsec_last_seen": "2026-04-23T12:53:40.780Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "16143"
      ],
      "x_nadsec_orgs": [
        "OOO NIIR-RadioNet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-23T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--5a228d66-cf85-4b33-9cfc-7a29e2fa1c62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.233.112.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T13:05:10.000Z",
      "valid_until": "2026-05-25T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-23T12:15:58.591Z",
      "x_nadsec_last_seen": "2026-04-23T12:16:09.847Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-23T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=11426; asn_org=Charter Communications Inc",
      "id": "indicator--2627b319-1fb3-4d17-bd4f-75a1cf039545",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.56.215.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T13:05:10.000Z",
      "valid_until": "2026-05-25T13:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-23T12:57:56.115Z",
      "x_nadsec_last_seen": "2026-04-24T00:07:38.640Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "11426"
      ],
      "x_nadsec_orgs": [
        "Charter Communications Inc"
      ]
    },
    {
      "created": "2026-04-23T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--4b9a0472-38ec-4841-a179-8d945bd29d15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.183.90.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T13:05:10.000Z",
      "valid_until": "2026-05-25T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T12:12:56.112Z",
      "x_nadsec_last_seen": "2026-04-23T12:12:56.112Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-23T14:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=HK; asn=10103; asn_org=HK Broadband Network Ltd.",
      "id": "indicator--b5edfc08-124e-47a0-a1ec-6e1e04996d10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T14:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '183.178.31.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T14:05:09.000Z",
      "valid_until": "2026-05-25T14:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-23T13:10:24.478Z",
      "x_nadsec_last_seen": "2026-04-23T13:14:55.201Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "10103"
      ],
      "x_nadsec_orgs": [
        "HK Broadband Network Ltd."
      ]
    },
    {
      "created": "2026-04-23T14:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--9985b8de-6de1-4a13-8ee0-d6a3dcd22ae5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T14:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T14:05:09.000Z",
      "valid_until": "2026-05-25T14:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T13:18:03.756Z",
      "x_nadsec_last_seen": "2026-04-23T13:18:03.756Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-04-23T14:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MU; asn=30844; asn_org=Liquid Telecommunications Ltd",
      "id": "indicator--80a56669-267b-4ad3-8ac6-af9ae8a094d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T14:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '217.21.118.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T14:05:09.000Z",
      "valid_until": "2026-05-25T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-23T13:12:39.882Z",
      "x_nadsec_last_seen": "2026-04-23T13:14:47.629Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MU"
      ],
      "x_nadsec_asns": [
        "30844"
      ],
      "x_nadsec_orgs": [
        "Liquid Telecommunications Ltd"
      ]
    },
    {
      "created": "2026-04-23T14:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=RU; asn=8359; asn_org=MTS PJSC; user(top)=**",
      "id": "indicator--2b4af062-2e10-4ccb-9883-1ae10c40711e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T14:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '83.237.72.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T14:05:09.000Z",
      "valid_until": "2026-05-25T14:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T13:08:24.234Z",
      "x_nadsec_last_seen": "2026-04-23T13:08:24.234Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8359"
      ],
      "x_nadsec_orgs": [
        "MTS PJSC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-23T15:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--bd0fa1ee-1daa-4708-a3eb-857d7f531109",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T15:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.52.139.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T15:05:16.000Z",
      "valid_until": "2026-05-25T15:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-23T14:37:16.821Z",
      "x_nadsec_last_seen": "2026-04-23T14:39:21.942Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-04-23T15:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--1564eba5-c075-4f62-b8be-6a6dfcb19f99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T15:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.172.71.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T15:05:16.000Z",
      "valid_until": "2026-05-25T15:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-23T14:13:07.513Z",
      "x_nadsec_last_seen": "2026-04-23T14:15:12.307Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-23T15:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mqttd; ports=1883; cc=FR; asn=211590; asn_org=Bucklog SARL",
      "id": "indicator--40c22dee-51cf-4a7e-8e1d-8f825758ab1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T15:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.177.72.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T15:05:16.000Z",
      "valid_until": "2026-05-25T15:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-23T14:31:26.710Z",
      "x_nadsec_last_seen": "2026-04-23T14:31:27.895Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "211590"
      ],
      "x_nadsec_orgs": [
        "Bucklog SARL"
      ]
    },
    {
      "created": "2026-04-23T15:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mqttd; ports=1883; cc=FR; asn=211590; asn_org=Bucklog SARL",
      "id": "indicator--82aae55c-0aa7-4846-b363-0365df29ff35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T15:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.177.72.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T15:05:16.000Z",
      "valid_until": "2026-05-25T15:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-23T14:41:49.540Z",
      "x_nadsec_last_seen": "2026-04-23T14:41:50.618Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "211590"
      ],
      "x_nadsec_orgs": [
        "Bucklog SARL"
      ]
    },
    {
      "created": "2026-04-23T15:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--06889dc6-e5ff-4bef-ad1a-0cd122891109",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T15:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.98.128.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T15:05:16.000Z",
      "valid_until": "2026-05-25T15:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-23T14:42:18.157Z",
      "x_nadsec_last_seen": "2026-04-23T14:42:28.339Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-23T15:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--38079a31-1976-41da-8b19-0a85d823b168",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T15:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T15:05:16.000Z",
      "valid_until": "2026-05-25T15:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-23T14:44:39.592Z",
      "x_nadsec_last_seen": "2026-04-27T14:37:05.826Z",
      "x_nadsec_ports": [
        "445",
        "1883"
      ],
      "x_nadsec_services": [
        "smbd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-23T15:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=50219; asn_org=Valence Technology Co.",
      "id": "indicator--c164523b-aca4-4806-bb93-dc9d70afdcf6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T15:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '216.226.76.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T15:05:16.000Z",
      "valid_until": "2026-05-25T15:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-23T14:39:26.305Z",
      "x_nadsec_last_seen": "2026-04-23T14:54:48.778Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "50219"
      ],
      "x_nadsec_orgs": [
        "Valence Technology Co."
      ]
    },
    {
      "created": "2026-04-23T15:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--28cda7ca-78ab-4bc2-9169-99f46ca9b9e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T15:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.71.194.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T15:05:16.000Z",
      "valid_until": "2026-05-25T15:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-23T14:18:11.380Z",
      "x_nadsec_last_seen": "2026-04-23T14:20:16.229Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-23T16:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--0dc5f1c4-6142-402d-93dc-566735765f92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T16:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.91.71.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T16:05:15.000Z",
      "valid_until": "2026-05-25T16:05:13.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-23T15:31:13.809Z",
      "x_nadsec_last_seen": "2026-04-23T15:38:56.850Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-04-23T16:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mysqld; ports=3306; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--67098fb7-693b-4bfc-9d45-6b30e2195f56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T16:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.87.89.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T16:05:15.000Z",
      "valid_until": "2026-05-25T16:05:13.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-04-23T15:44:58.681Z",
      "x_nadsec_last_seen": "2026-04-23T15:44:59.702Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-23T16:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--575375d3-64d6-42fa-97fe-9c9ca7a7a676",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T16:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T16:05:15.000Z",
      "valid_until": "2026-05-25T16:05:13.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T16:03:22.232Z",
      "x_nadsec_last_seen": "2026-04-23T16:03:22.232Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-23T16:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=61699; asn_org=Fernando Oliveira Cambuhy Informatica - ME",
      "id": "indicator--dfbc03d2-0ef2-46d4-84fe-7842d96dee33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T16:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '201.150.52.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T16:05:15.000Z",
      "valid_until": "2026-05-25T16:05:13.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-23T15:28:30.980Z",
      "x_nadsec_last_seen": "2026-04-23T15:28:31.081Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "61699"
      ],
      "x_nadsec_orgs": [
        "Fernando Oliveira Cambuhy Informatica - ME"
      ]
    },
    {
      "created": "2026-04-23T16:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--26e99e55-59bf-44b0-badb-868e3229f37e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T16:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '52.248.40.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T16:05:15.000Z",
      "valid_until": "2026-05-25T16:05:13.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T15:15:26.823Z",
      "x_nadsec_last_seen": "2026-04-23T15:15:26.823Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-23T16:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ES; asn=39353; asn_org=Gobierno del Principado de Asturias",
      "id": "indicator--444f4b35-58f2-4418-a8c5-84cf8bf2e643",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T16:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '88.151.19.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T16:05:15.000Z",
      "valid_until": "2026-05-25T16:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-23T15:15:37.625Z",
      "x_nadsec_last_seen": "2026-04-23T15:16:20.303Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "39353"
      ],
      "x_nadsec_orgs": [
        "Gobierno del Principado de Asturias"
      ]
    },
    {
      "created": "2026-04-23T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=38841; asn_org=kbro CO. Ltd.",
      "id": "indicator--6054b759-af00-42d2-9364-3a82217c5566",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '123.195.64.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T17:05:11.000Z",
      "valid_until": "2026-05-25T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-23T16:23:59.693Z",
      "x_nadsec_last_seen": "2026-04-23T16:26:04.481Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "38841"
      ],
      "x_nadsec_orgs": [
        "kbro CO. Ltd."
      ]
    },
    {
      "created": "2026-04-23T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=JP; asn=135161; asn_org=GMO-Z com NetDesign Holdings Co., Ltd.",
      "id": "indicator--ceab398a-6ba1-45f3-a23a-443465481d2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '150.95.90.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T17:05:11.000Z",
      "valid_until": "2026-05-25T17:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-23T16:27:07.215Z",
      "x_nadsec_last_seen": "2026-04-23T16:27:07.353Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "135161"
      ],
      "x_nadsec_orgs": [
        "GMO-Z com NetDesign Holdings Co., Ltd."
      ]
    },
    {
      "created": "2026-04-23T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=38482; asn_org=Biznet ISP",
      "id": "indicator--00055c8a-af74-4d5b-a002-c32f0b0ecf8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '203.142.83.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T17:05:11.000Z",
      "valid_until": "2026-05-25T17:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-23T16:14:20.038Z",
      "x_nadsec_last_seen": "2026-04-23T16:16:24.298Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "38482"
      ],
      "x_nadsec_orgs": [
        "Biznet ISP"
      ]
    },
    {
      "created": "2026-04-23T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=UZ; asn=64466; asn_org=Universal Mobile Systems Lcc; user(top)=a***n; pass(top)=t*****g",
      "id": "indicator--af6673f0-d5d7-4d0f-88f8-6fa9ec142802",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.213.229.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T19:05:10.000Z",
      "valid_until": "2026-05-25T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T18:08:44.690Z",
      "x_nadsec_last_seen": "2026-04-23T18:08:44.690Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "UZ"
      ],
      "x_nadsec_asns": [
        "64466"
      ],
      "x_nadsec_orgs": [
        "Universal Mobile Systems Lcc"
      ],
      "x_nadsec_usernames_attempted": [
        "a***n"
      ],
      "x_nadsec_passwords_attempted": [
        "t*****g"
      ]
    },
    {
      "created": "2026-04-23T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--2189844c-a6b4-48cd-bddf-d32ae1f43109",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T22:05:10.000Z",
      "valid_until": "2026-05-25T22:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T21:40:08.522Z",
      "x_nadsec_last_seen": "2026-04-23T21:40:08.522Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-23T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--5248052d-fd15-4102-8b4d-80b457a5b775",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T22:05:10.000Z",
      "valid_until": "2026-05-25T22:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-23T21:14:20.446Z",
      "x_nadsec_last_seen": "2026-04-24T21:16:21.139Z",
      "x_nadsec_ports": [
        "81",
        "1723"
      ],
      "x_nadsec_services": [
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-23T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--adf0351f-16ef-4498-9767-d3ef9200b38b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '153.37.228.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T23:05:10.000Z",
      "valid_until": "2026-05-25T23:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T22:38:45.072Z",
      "x_nadsec_last_seen": "2026-04-23T22:38:45.072Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-04-23T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=57334; asn_org=SPB State Unitary Enterprise ATS Smolnogo",
      "id": "indicator--4909f12f-6168-47d1-973d-543bc9d0c44e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.183.29.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T23:05:10.000Z",
      "valid_until": "2026-05-25T23:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-23T22:40:10.718Z",
      "x_nadsec_last_seen": "2026-04-23T22:42:17.760Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "57334"
      ],
      "x_nadsec_orgs": [
        "SPB State Unitary Enterprise ATS Smolnogo"
      ]
    },
    {
      "created": "2026-04-24T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--3a8ed086-890b-4f89-bee0-9d868ef3ef18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '114.34.249.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T00:05:12.000Z",
      "valid_until": "2026-05-26T00:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-23T23:29:31.516Z",
      "x_nadsec_last_seen": "2026-04-23T23:36:52.234Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-24T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--5477fdbb-b544-47ba-af36-e729518d108e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.193.36.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T00:05:12.000Z",
      "valid_until": "2026-05-26T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T23:41:23.139Z",
      "x_nadsec_last_seen": "2026-04-23T23:41:23.139Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-24T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=NL; asn=8075; asn_org=Microsoft Corporation; user(top)=**",
      "id": "indicator--2ee1ec7f-3580-49f0-895f-61e941354f57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '137.117.183.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T00:05:12.000Z",
      "valid_until": "2026-05-26T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T23:39:54.034Z",
      "x_nadsec_last_seen": "2026-04-23T23:39:54.034Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-24T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e1286b59-967a-42eb-ba70-cd3d5f4071f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '137.184.18.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T00:05:12.000Z",
      "valid_until": "2026-05-26T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T23:28:36.881Z",
      "x_nadsec_last_seen": "2026-04-23T23:28:36.881Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-24T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=AU; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--1bd9894b-1c3d-42a0-8e89-bd27eb40ac15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '170.64.173.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T00:05:12.000Z",
      "valid_until": "2026-05-26T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T23:39:12.794Z",
      "x_nadsec_last_seen": "2026-04-23T23:39:12.794Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-24T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=26599; asn_org=TELEFONICA BRASIL S.A; user(top)=**",
      "id": "indicator--26486abc-a58a-4d46-9f1b-b496495b4cd7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '191.15.8.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T00:05:12.000Z",
      "valid_until": "2026-05-26T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T23:54:45.649Z",
      "x_nadsec_last_seen": "2026-04-23T23:54:45.649Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "26599"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-24T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=50219; asn_org=Valence Technology Co.",
      "id": "indicator--87d65e9c-00e3-4d2a-9dec-c99177323301",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '216.226.76.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T00:05:12.000Z",
      "valid_until": "2026-05-26T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-23T23:14:46.098Z",
      "x_nadsec_last_seen": "2026-04-23T23:30:08.505Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "50219"
      ],
      "x_nadsec_orgs": [
        "Valence Technology Co."
      ]
    },
    {
      "created": "2026-04-24T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=GB; asn=396982; asn_org=Google LLC",
      "id": "indicator--f3218cfc-2deb-4ee2-ad31-1a40f0a43d2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.203.211.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T00:05:12.000Z",
      "valid_until": "2026-05-26T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-23T23:11:41.804Z",
      "x_nadsec_last_seen": "2026-04-23T23:11:51.807Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-24T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CH; asn=29222; asn_org=Infomaniak Network SA; user(top)=**; pass(top)=1****6",
      "id": "indicator--01591e47-dc82-43ff-8039-0f009e501545",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '84.234.20.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T00:05:12.000Z",
      "valid_until": "2026-05-26T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-23T23:20:18.606Z",
      "x_nadsec_last_seen": "2026-04-23T23:20:18.606Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "29222"
      ],
      "x_nadsec_orgs": [
        "Infomaniak Network SA"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6"
      ]
    },
    {
      "created": "2026-04-24T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=139983; asn_org=PT. Borneo Cakrawala Media",
      "id": "indicator--dc25e584-31db-476b-95a7-7ec4c1d7a6aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.148.49.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T01:05:10.000Z",
      "valid_until": "2026-05-26T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-24T00:16:23.177Z",
      "x_nadsec_last_seen": "2026-04-24T00:18:28.388Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "139983"
      ],
      "x_nadsec_orgs": [
        "PT. Borneo Cakrawala Media"
      ]
    },
    {
      "created": "2026-04-24T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--bb2027be-1f51-4bcc-9cce-ed2dc0ac6a76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.131.51.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T01:05:10.000Z",
      "valid_until": "2026-05-26T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T00:36:43.903Z",
      "x_nadsec_last_seen": "2026-04-24T00:36:43.903Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-24T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=GB; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--681afa0e-b154-4d2e-9d19-136dc4c3112c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '161.35.33.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T01:05:10.000Z",
      "valid_until": "2026-05-26T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T00:17:53.640Z",
      "x_nadsec_last_seen": "2026-04-24T00:17:53.640Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-24T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6403708d-245f-41eb-b524-67e0e647ee11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '168.144.32.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T01:05:10.000Z",
      "valid_until": "2026-05-26T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T00:58:38.534Z",
      "x_nadsec_last_seen": "2026-04-26T11:40:53.140Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-24T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=50219; asn_org=Valence Technology Co.",
      "id": "indicator--825f334a-48d5-4ce9-9f15-51fbd5e7e321",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.164.107.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T01:05:10.000Z",
      "valid_until": "2026-05-26T01:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-24T00:48:20.595Z",
      "x_nadsec_last_seen": "2026-04-29T06:55:28.917Z",
      "x_nadsec_ports": [
        "1433",
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "50219"
      ],
      "x_nadsec_orgs": [
        "Valence Technology Co."
      ]
    },
    {
      "created": "2026-04-24T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--31d2f428-012e-412d-bb6d-85d0b2070dd3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.106.205.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T01:05:10.000Z",
      "valid_until": "2026-05-26T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T00:31:27.058Z",
      "x_nadsec_last_seen": "2026-04-24T00:31:27.058Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-24T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--91c03149-35cd-4012-a245-5a489fc6f24b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '54.159.23.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T01:05:10.000Z",
      "valid_until": "2026-05-26T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T01:00:10.613Z",
      "x_nadsec_last_seen": "2026-04-24T01:00:10.613Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-24T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CA; asn=12989; asn_org=Black HOST Ltd",
      "id": "indicator--8068fd46-03f5-4476-9078-d4da6165f6a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '86.54.31.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T01:05:10.000Z",
      "valid_until": "2026-05-26T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T00:50:41.185Z",
      "x_nadsec_last_seen": "2026-04-24T00:50:41.185Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "12989"
      ],
      "x_nadsec_orgs": [
        "Black HOST Ltd"
      ]
    },
    {
      "created": "2026-04-24T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--a3f6cd8d-1163-4b8e-8c88-1130252612f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.199.4.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T02:05:10.000Z",
      "valid_until": "2026-05-26T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T01:15:17.694Z",
      "x_nadsec_last_seen": "2026-04-24T01:15:17.694Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-24T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--5596795d-e326-46f5-84d9-af0a85f16a61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '168.144.45.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T02:05:10.000Z",
      "valid_until": "2026-05-26T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T01:33:49.432Z",
      "x_nadsec_last_seen": "2026-04-24T01:33:49.432Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-24T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=TW; asn=208137; asn_org=Feo Prest SRL",
      "id": "indicator--2768cece-d4d5-4256-af66-e2797141e538",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '213.177.179.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T02:05:10.000Z",
      "valid_until": "2026-05-26T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T01:25:16.780Z",
      "x_nadsec_last_seen": "2026-04-28T23:36:32.172Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "208137"
      ],
      "x_nadsec_orgs": [
        "Feo Prest SRL"
      ]
    },
    {
      "created": "2026-04-24T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--d3f2322c-82dd-481a-aaf2-03838c091a3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '27.72.174.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T02:05:10.000Z",
      "valid_until": "2026-05-26T02:05:09.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-04-24T01:49:35.334Z",
      "x_nadsec_last_seen": "2026-04-24T01:51:29.781Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-24T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--6365576e-b74a-4332-950c-6d5134884523",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.250.43.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T02:05:10.000Z",
      "valid_until": "2026-05-26T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T01:34:38.865Z",
      "x_nadsec_last_seen": "2026-04-24T01:34:38.865Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-24T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ES; asn=12430; asn_org=Vodafone Spain",
      "id": "indicator--4df41694-8d21-4e0b-ad42-124ad3afbe51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.62.4.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T02:05:10.000Z",
      "valid_until": "2026-05-26T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-24T01:29:06.457Z",
      "x_nadsec_last_seen": "2026-04-24T01:31:12.520Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "12430"
      ],
      "x_nadsec_orgs": [
        "Vodafone Spain"
      ]
    },
    {
      "created": "2026-04-24T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=136873; asn_org=MEGADATA-ISP",
      "id": "indicator--fc6bfbe9-e1c2-4aaa-8ba3-00dd22745bcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.213.234.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T03:05:11.000Z",
      "valid_until": "2026-05-26T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-24T02:50:07.647Z",
      "x_nadsec_last_seen": "2026-04-24T02:52:11.918Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "136873"
      ],
      "x_nadsec_orgs": [
        "MEGADATA-ISP"
      ]
    },
    {
      "created": "2026-04-24T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--012c3028-0659-43aa-95df-d03ed9f82ba5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '134.209.166.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T03:05:11.000Z",
      "valid_until": "2026-05-26T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T02:19:12.418Z",
      "x_nadsec_last_seen": "2026-04-24T02:19:12.418Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-24T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--76db2443-41d0-4d37-af83-cc04d80bc6e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '168.144.111.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T03:05:11.000Z",
      "valid_until": "2026-05-26T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T02:08:09.624Z",
      "x_nadsec_last_seen": "2026-04-24T02:08:09.624Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-24T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=24835; asn_org=RAYA Telecom - Egypt",
      "id": "indicator--d8056de1-72a6-48d3-8acd-e047a338bd2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.134.255.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T03:05:11.000Z",
      "valid_until": "2026-05-26T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-24T02:42:45.827Z",
      "x_nadsec_last_seen": "2026-04-24T02:44:52.390Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24835"
      ],
      "x_nadsec_orgs": [
        "RAYA Telecom - Egypt"
      ]
    },
    {
      "created": "2026-04-24T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--6691b016-00e6-4fc5-924d-7bc6610d567c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '222.252.76.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T03:05:11.000Z",
      "valid_until": "2026-05-26T03:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-24T02:56:35.820Z",
      "x_nadsec_last_seen": "2026-04-24T03:03:20.698Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-24T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--b9e6416b-7984-4389-baca-d0b564e5bdd5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '222.85.110.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T03:05:11.000Z",
      "valid_until": "2026-05-26T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T02:42:48.749Z",
      "x_nadsec_last_seen": "2026-04-24T02:42:49.076Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-24T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=37693; asn_org=TUNISIANA",
      "id": "indicator--917ffdda-f02a-4231-870f-cece02c98050",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.228.22.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T03:05:11.000Z",
      "valid_until": "2026-05-26T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-24T02:30:53.446Z",
      "x_nadsec_last_seen": "2026-04-24T02:32:59.894Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37693"
      ],
      "x_nadsec_orgs": [
        "TUNISIANA"
      ]
    },
    {
      "created": "2026-04-24T04:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=134877; asn_org=Sri Vari Network Private Limited",
      "id": "indicator--742b23aa-808a-46bd-a27a-bc7b94d2330c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T04:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.148.33.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T04:05:16.000Z",
      "valid_until": "2026-05-26T04:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-24T03:40:04.294Z",
      "x_nadsec_last_seen": "2026-04-24T03:46:52.916Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134877"
      ],
      "x_nadsec_orgs": [
        "Sri Vari Network Private Limited"
      ]
    },
    {
      "created": "2026-04-24T04:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--fbafd50f-b559-470f-b00f-079eff6c1f58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T04:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.182.148.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T04:05:16.000Z",
      "valid_until": "2026-05-26T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-24T03:10:02.029Z",
      "x_nadsec_last_seen": "2026-04-24T03:10:06.580Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-24T04:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--8bbcb272-94f0-46d0-856e-cd160eefcfec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T04:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.146.186.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T04:05:16.000Z",
      "valid_until": "2026-05-26T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T03:37:45.656Z",
      "x_nadsec_last_seen": "2026-04-24T03:37:45.749Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-04-24T04:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=BG; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--f9ba9abf-5f2e-4892-a96d-d077d3170e0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T04:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '192.109.200.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T04:05:16.000Z",
      "valid_until": "2026-05-26T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T03:16:23.427Z",
      "x_nadsec_last_seen": "2026-04-25T00:30:39.311Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-04-24T04:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--ca457940-96d9-4361-8019-c61df5d02c25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T04:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T04:05:16.000Z",
      "valid_until": "2026-05-26T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T03:50:09.065Z",
      "x_nadsec_last_seen": "2026-04-24T03:50:09.065Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-24T04:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--11c26fe9-2bbc-426f-bb6f-fa3fd625be9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T04:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T04:05:16.000Z",
      "valid_until": "2026-05-26T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T03:50:08.560Z",
      "x_nadsec_last_seen": "2026-04-24T03:50:08.560Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-24T04:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=AU; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b5f4f172-256d-4190-b9c1-a4f381e4968a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T04:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '209.38.25.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T04:05:16.000Z",
      "valid_until": "2026-05-26T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T03:47:11.989Z",
      "x_nadsec_last_seen": "2026-04-24T03:47:11.989Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-24T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--51096163-93a0-48cc-8584-d8fe82cc9012",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.236.40.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T05:05:10.000Z",
      "valid_until": "2026-05-26T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T05:01:12.427Z",
      "x_nadsec_last_seen": "2026-04-24T05:01:12.427Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-24T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IT; asn=30722; asn_org=Fastweb",
      "id": "indicator--434b4373-35ea-4397-a287-24b08f1fc4df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '109.117.222.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T05:05:10.000Z",
      "valid_until": "2026-05-26T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T04:05:31.378Z",
      "x_nadsec_last_seen": "2026-04-24T04:05:31.446Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "30722"
      ],
      "x_nadsec_orgs": [
        "Fastweb"
      ]
    },
    {
      "created": "2026-04-24T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=51167; asn_org=Contabo GmbH; user(top)=**",
      "id": "indicator--bc19a7bc-f122-4472-b77d-a94fe6921f51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '161.97.178.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T05:05:10.000Z",
      "valid_until": "2026-05-26T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T04:38:17.076Z",
      "x_nadsec_last_seen": "2026-04-24T04:38:17.076Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "51167"
      ],
      "x_nadsec_orgs": [
        "Contabo GmbH"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-24T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--72732dc8-8e47-4212-8ed6-343b22292b43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '167.71.171.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T05:05:10.000Z",
      "valid_until": "2026-05-26T05:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-24T04:52:51.166Z",
      "x_nadsec_last_seen": "2026-04-30T12:37:18.756Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-24T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--3e7f88de-0279-4081-b89f-0c3169e7b59d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '61.220.241.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T05:05:10.000Z",
      "valid_until": "2026-05-26T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T04:45:31.657Z",
      "x_nadsec_last_seen": "2026-04-24T04:45:32.340Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-24T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--b7f73a82-b59b-47d9-87a0-28f46c100566",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T05:05:10.000Z",
      "valid_until": "2026-05-26T05:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-09T19:33:35.054Z",
      "x_nadsec_last_seen": "2026-04-24T04:38:48.474Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-24T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=21056; asn_org=Vianova S.p.A",
      "id": "indicator--30261058-b764-4ca4-ab4e-09ab76c7ad6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.61.187.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T06:05:10.000Z",
      "valid_until": "2026-05-26T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-24T05:49:34.975Z",
      "x_nadsec_last_seen": "2026-04-24T05:51:41.304Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "21056"
      ],
      "x_nadsec_orgs": [
        "Vianova S.p.A"
      ]
    },
    {
      "created": "2026-04-24T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3149; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--ebb08840-c4a7-4d40-91e1-6028b4cd63e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.191.34.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T06:05:10.000Z",
      "valid_until": "2026-05-26T06:05:09.000Z",
      "x_nadsec_event_count": 3149,
      "x_nadsec_first_seen": "2026-04-24T05:22:28.929Z",
      "x_nadsec_last_seen": "2026-04-24T05:50:59.408Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-24T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=JP; asn=2514; asn_org=NTT PC Communications, Inc.",
      "id": "indicator--5bac5300-4b4b-444d-919b-6d2f7a7e1098",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '157.120.0.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T06:05:10.000Z",
      "valid_until": "2026-05-26T06:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-24T05:39:58.372Z",
      "x_nadsec_last_seen": "2026-04-26T13:00:35.126Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "2514"
      ],
      "x_nadsec_orgs": [
        "NTT PC Communications, Inc."
      ]
    },
    {
      "created": "2026-04-24T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--273962c5-7630-4200-b1fd-80dc0e4ae0e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '164.90.142.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T06:05:10.000Z",
      "valid_until": "2026-05-26T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T05:45:03.924Z",
      "x_nadsec_last_seen": "2026-04-24T05:45:03.924Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-24T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--9b51d927-6172-4ad5-9d10-c49db6e3ba09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '180.252.217.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T06:05:10.000Z",
      "valid_until": "2026-05-26T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-24T05:41:24.352Z",
      "x_nadsec_last_seen": "2026-04-24T05:47:46.734Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-24T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IE; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--19cc3782-2e09-4660-ae62-6f70698b922f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.82.185.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T06:05:10.000Z",
      "valid_until": "2026-05-26T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T05:18:49.469Z",
      "x_nadsec_last_seen": "2026-04-24T05:18:49.712Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IE"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-24T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--c28643e9-25aa-4d57-8a52-89ed858c4b87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T06:05:10.000Z",
      "valid_until": "2026-05-26T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T05:34:55.212Z",
      "x_nadsec_last_seen": "2026-04-24T05:34:55.212Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-24T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--237bf5a8-168b-4b3a-8167-7f81f8df985a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T07:05:10.000Z",
      "valid_until": "2026-05-26T07:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-24T06:20:02.937Z",
      "x_nadsec_last_seen": "2026-04-24T06:20:03.730Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-24T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=5033; asn_org=Key Information Systems, Inc.",
      "id": "indicator--7ffe5435-1bab-447e-af7d-f3c48c3aad8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '207.178.215.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T07:05:10.000Z",
      "valid_until": "2026-05-26T07:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-22T18:53:14.169Z",
      "x_nadsec_last_seen": "2026-04-30T22:34:07.939Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "5033"
      ],
      "x_nadsec_orgs": [
        "Key Information Systems, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-24T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--6dc4dbba-c7de-464b-bd75-d49ff1ddf49a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.74.230.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T07:05:10.000Z",
      "valid_until": "2026-05-26T07:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-24T06:31:23.301Z",
      "x_nadsec_last_seen": "2026-04-24T06:35:49.432Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-24T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=41704; asn_org=JSC Ufanet",
      "id": "indicator--dc3c5fdd-4aa2-4cd8-878d-7e65a27e9fba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '95.105.118.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T07:05:10.000Z",
      "valid_until": "2026-05-26T07:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T07:04:40.901Z",
      "x_nadsec_last_seen": "2026-04-24T07:04:41.614Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "41704"
      ],
      "x_nadsec_orgs": [
        "JSC Ufanet"
      ]
    },
    {
      "created": "2026-04-24T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=12; services=smbd; ports=445; cc=US; asn=701; asn_org=Verizon Business",
      "id": "indicator--997b93f7-5849-4098-a5e9-9ec48a0cd275",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '108.2.159.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T08:05:05.000Z",
      "valid_until": "2026-05-26T08:05:04.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-04-24T07:32:35.217Z",
      "x_nadsec_last_seen": "2026-04-24T07:33:26.830Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "701"
      ],
      "x_nadsec_orgs": [
        "Verizon Business"
      ]
    },
    {
      "created": "2026-04-24T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=639; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--4f8f31c8-9482-42d4-94f7-fe90f1663443",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '125.235.237.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T08:05:05.000Z",
      "valid_until": "2026-05-26T08:05:04.000Z",
      "x_nadsec_event_count": 3149,
      "x_nadsec_first_seen": "2026-04-24T07:44:23.472Z",
      "x_nadsec_last_seen": "2026-04-24T08:30:32.310Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-24T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--1226c05c-6951-4e6a-b6bd-5faa7367ad2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '157.245.4.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T08:05:05.000Z",
      "valid_until": "2026-05-26T08:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T07:58:30.963Z",
      "x_nadsec_last_seen": "2026-04-24T12:41:54.395Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "c**n"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-24T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b341ffc7-0a8b-4593-b27b-1bd84ab91ff4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '159.223.63.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T08:05:05.000Z",
      "valid_until": "2026-05-26T08:05:04.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-24T07:25:51.308Z",
      "x_nadsec_last_seen": "2026-04-30T22:37:20.986Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-24T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=16276; asn_org=OVH SAS; user(top)=**; pass(top)=1****6",
      "id": "indicator--32556f89-ab08-4873-b2c5-34343392ff61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.32.188.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T08:05:05.000Z",
      "valid_until": "2026-05-26T08:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T07:50:41.195Z",
      "x_nadsec_last_seen": "2026-04-24T07:50:41.195Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6"
      ]
    },
    {
      "created": "2026-04-24T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=262988; asn_org=Pombonet Telecomunicacoes e Informatica",
      "id": "indicator--50eb9a28-da2d-4551-833b-5acefd10b67f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '179.125.91.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T08:05:05.000Z",
      "valid_until": "2026-05-26T08:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-24T07:50:28.504Z",
      "x_nadsec_last_seen": "2026-04-24T07:57:33.060Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262988"
      ],
      "x_nadsec_orgs": [
        "Pombonet Telecomunicacoes e Informatica"
      ]
    },
    {
      "created": "2026-04-24T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8e4740ae-f2e3-43da-91c5-368928b7815f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.192.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T08:05:05.000Z",
      "valid_until": "2026-05-26T08:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T07:10:56.743Z",
      "x_nadsec_last_seen": "2026-04-24T07:10:57.107Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-24T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=MX; asn=13999; asn_org=Mega Cable, S.A. de C.V.; user(top)=**",
      "id": "indicator--35c20e11-587e-446f-9865-6fbaa38945c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '201.165.139.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T08:05:05.000Z",
      "valid_until": "2026-05-26T08:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-24T07:08:04.304Z",
      "x_nadsec_last_seen": "2026-04-26T06:27:22.739Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "13999"
      ],
      "x_nadsec_orgs": [
        "Mega Cable, S.A. de C.V."
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-24T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=23951; asn_org=PT JEMBATAN CITRA NUSANTARA",
      "id": "indicator--80be61e7-0e1a-4796-8033-f9baf9f657f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '202.65.121.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T08:05:05.000Z",
      "valid_until": "2026-05-26T08:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-24T07:38:20.962Z",
      "x_nadsec_last_seen": "2026-04-24T07:40:25.375Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23951"
      ],
      "x_nadsec_orgs": [
        "PT JEMBATAN CITRA NUSANTARA"
      ]
    },
    {
      "created": "2026-04-24T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--17e8bd51-78a3-48b3-a7ba-3b28b1fa2eb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.228.53.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T08:05:05.000Z",
      "valid_until": "2026-05-26T08:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T08:04:16.449Z",
      "x_nadsec_last_seen": "2026-04-24T08:04:16.791Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-24T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=21378; asn_org=Rostelecom",
      "id": "indicator--6d70fde8-30c2-4803-a5be-516d47f56431",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '84.42.24.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T08:05:05.000Z",
      "valid_until": "2026-05-26T08:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-24T07:58:59.633Z",
      "x_nadsec_last_seen": "2026-04-24T08:06:09.878Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "21378"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-24T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=LU; asn=53667; asn_org=FranTech Solutions",
      "id": "indicator--9bfe0030-5e16-4a31-8887-daf4174d3688",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '107.189.3.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:05:04.000Z",
      "valid_until": "2026-05-26T09:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T09:04:25.328Z",
      "x_nadsec_last_seen": "2026-04-24T09:04:25.328Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "LU"
      ],
      "x_nadsec_asns": [
        "53667"
      ],
      "x_nadsec_orgs": [
        "FranTech Solutions"
      ]
    },
    {
      "created": "2026-04-24T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--eeebd287-c2db-45de-808c-0a5e1f49b497",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '110.136.57.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:05:04.000Z",
      "valid_until": "2026-05-26T09:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-24T08:16:25.463Z",
      "x_nadsec_last_seen": "2026-04-24T08:18:30.932Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-24T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--2d6bc56f-87b9-40aa-8e01-05edb1fd8f14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.173.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:05:04.000Z",
      "valid_until": "2026-05-26T09:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T08:40:53.654Z",
      "x_nadsec_last_seen": "2026-04-24T08:40:53.654Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-24T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=DE; asn=205100; asn_org=F3 Netze e.V.",
      "id": "indicator--df2c0606-7fd6-4524-aeed-11f422dbd858",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.220.100.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:05:04.000Z",
      "valid_until": "2026-05-26T09:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T09:04:46.573Z",
      "x_nadsec_last_seen": "2026-04-24T09:04:47.544Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "205100"
      ],
      "x_nadsec_orgs": [
        "F3 Netze e.V."
      ]
    },
    {
      "created": "2026-04-24T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=DE; asn=60729; asn_org=Stiftung Erneuerbare Freiheit",
      "id": "indicator--a6ea6fbd-6dbb-468f-8006-9ecba45a02ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:05:04.000Z",
      "valid_until": "2026-05-26T09:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T09:04:03.827Z",
      "x_nadsec_last_seen": "2026-04-24T09:04:03.827Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "60729"
      ],
      "x_nadsec_orgs": [
        "Stiftung Erneuerbare Freiheit"
      ]
    },
    {
      "created": "2026-04-24T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=GB; asn=20860; asn_org=Iomart Cloud Services Limited",
      "id": "indicator--7a115470-acf7-4ac3-845b-b79f20b6bf37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '212.38.189.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:05:04.000Z",
      "valid_until": "2026-05-26T09:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-24T09:04:13.759Z",
      "x_nadsec_last_seen": "2026-04-24T09:04:15.374Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "20860"
      ],
      "x_nadsec_orgs": [
        "Iomart Cloud Services Limited"
      ]
    },
    {
      "created": "2026-04-24T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--f8f450be-c194-4f4d-b951-30a7ce2684f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '219.145.108.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:05:04.000Z",
      "valid_until": "2026-05-26T09:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T09:02:21.660Z",
      "x_nadsec_last_seen": "2026-04-24T09:02:21.660Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-24T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=SE; asn=214503; asn_org=QuxLabs AB",
      "id": "indicator--7b45c904-6ddc-4ed5-880f-2c2846ce8027",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:05:04.000Z",
      "valid_until": "2026-05-26T09:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T09:04:35.526Z",
      "x_nadsec_last_seen": "2026-04-24T09:04:36.572Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SE"
      ],
      "x_nadsec_asns": [
        "214503"
      ],
      "x_nadsec_orgs": [
        "QuxLabs AB"
      ]
    },
    {
      "created": "2026-04-24T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SE; asn=214503; asn_org=QuxLabs AB",
      "id": "indicator--65ccce02-21f3-4357-b51b-fd5dceb94b14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:05:04.000Z",
      "valid_until": "2026-05-26T09:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T09:04:57.506Z",
      "x_nadsec_last_seen": "2026-04-24T09:04:57.506Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SE"
      ],
      "x_nadsec_asns": [
        "214503"
      ],
      "x_nadsec_orgs": [
        "QuxLabs AB"
      ]
    },
    {
      "created": "2026-04-24T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--ece707e1-df3c-4035-9dad-083951faff33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:05:04.000Z",
      "valid_until": "2026-05-26T09:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T08:31:56.628Z",
      "x_nadsec_last_seen": "2026-04-24T08:31:56.628Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-24T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--6c17f8e9-8811-4c7d-8192-a0e822eb56b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '125.161.90.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T10:05:10.000Z",
      "valid_until": "2026-05-26T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-24T09:34:10.428Z",
      "x_nadsec_last_seen": "2026-04-24T09:36:15.773Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-24T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--c08dcf5b-be0b-4ecb-8381-ac98d0c94775",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '168.144.38.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T10:05:10.000Z",
      "valid_until": "2026-05-26T10:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-24T09:55:22.610Z",
      "x_nadsec_last_seen": "2026-04-29T09:30:26.872Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-24T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=SE; asn=198093; asn_org=Foreningen for digitala fri- och rattigheter",
      "id": "indicator--1d8cfe3c-f652-4314-a3c4-bbc8d3f74905",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '171.25.193.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T10:05:10.000Z",
      "valid_until": "2026-05-26T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T09:05:51.954Z",
      "x_nadsec_last_seen": "2026-04-24T09:05:52.837Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SE"
      ],
      "x_nadsec_asns": [
        "198093"
      ],
      "x_nadsec_orgs": [
        "Foreningen for digitala fri- och rattigheter"
      ]
    },
    {
      "created": "2026-04-24T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=DE; asn=205100; asn_org=F3 Netze e.V.",
      "id": "indicator--b7d0f0cb-da4d-4717-86a6-4640c6cc1933",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.220.100.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T10:05:10.000Z",
      "valid_until": "2026-05-26T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T09:05:41.894Z",
      "x_nadsec_last_seen": "2026-04-24T09:05:41.894Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "205100"
      ],
      "x_nadsec_orgs": [
        "F3 Netze e.V."
      ]
    },
    {
      "created": "2026-04-24T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=DE; asn=60729; asn_org=Stiftung Erneuerbare Freiheit",
      "id": "indicator--e32a66d7-68f2-4f3d-b09c-f5b70783b912",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T10:05:10.000Z",
      "valid_until": "2026-05-26T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T09:05:30.078Z",
      "x_nadsec_last_seen": "2026-04-24T09:05:30.078Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "60729"
      ],
      "x_nadsec_orgs": [
        "Stiftung Erneuerbare Freiheit"
      ]
    },
    {
      "created": "2026-04-24T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=DE; asn=60729; asn_org=Stiftung Erneuerbare Freiheit",
      "id": "indicator--68054dae-5c39-4830-a222-6e056599a473",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T10:05:10.000Z",
      "valid_until": "2026-05-26T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T09:05:19.298Z",
      "x_nadsec_last_seen": "2026-04-24T09:05:19.298Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "60729"
      ],
      "x_nadsec_orgs": [
        "Stiftung Erneuerbare Freiheit"
      ]
    },
    {
      "created": "2026-04-24T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=PL; asn=210558; asn_org=1337 Services GmbH",
      "id": "indicator--c679497d-2118-4d39-9194-651c6d31f913",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.241.208.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T10:05:10.000Z",
      "valid_until": "2026-05-26T10:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-24T09:06:02.746Z",
      "x_nadsec_last_seen": "2026-04-24T09:06:13.530Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "210558"
      ],
      "x_nadsec_orgs": [
        "1337 Services GmbH"
      ]
    },
    {
      "created": "2026-04-24T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SE; asn=30893; asn_org=No ACK Group Holding AB",
      "id": "indicator--897a53ee-623b-440f-a46c-23b809ef2120",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.47.238.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T10:05:10.000Z",
      "valid_until": "2026-05-26T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T09:05:30.896Z",
      "x_nadsec_last_seen": "2026-04-24T09:05:30.896Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SE"
      ],
      "x_nadsec_asns": [
        "30893"
      ],
      "x_nadsec_orgs": [
        "No ACK Group Holding AB"
      ]
    },
    {
      "created": "2026-04-24T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--da7d4270-4750-4078-b5e2-942f91b78570",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.52.156.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T10:05:10.000Z",
      "valid_until": "2026-05-26T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T09:53:26.782Z",
      "x_nadsec_last_seen": "2026-04-24T09:53:26.782Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-24T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=27284; asn_org=Fourplex Telecom LLC",
      "id": "indicator--d3398724-c1c8-499a-8ab8-201acea1c93c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '38.135.24.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T10:05:10.000Z",
      "valid_until": "2026-05-26T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T09:05:08.258Z",
      "x_nadsec_last_seen": "2026-04-24T09:05:09.172Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "27284"
      ],
      "x_nadsec_orgs": [
        "Fourplex Telecom LLC"
      ]
    },
    {
      "created": "2026-04-24T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=NL; asn=210558; asn_org=1337 Services GmbH",
      "id": "indicator--0fc4c120-185b-464e-99c2-eb9e24b7dd09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.154.98.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T10:05:10.000Z",
      "valid_until": "2026-05-26T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T09:06:35.077Z",
      "x_nadsec_last_seen": "2026-04-24T09:06:45.975Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "210558"
      ],
      "x_nadsec_orgs": [
        "1337 Services GmbH"
      ]
    },
    {
      "created": "2026-04-24T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=PL; asn=210558; asn_org=1337 Services GmbH",
      "id": "indicator--97a5c3e6-1327-4973-baf4-34ebd3c39846",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.80.158.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T10:05:10.000Z",
      "valid_until": "2026-05-26T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T09:06:35.900Z",
      "x_nadsec_last_seen": "2026-04-24T09:06:35.900Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "210558"
      ],
      "x_nadsec_orgs": [
        "1337 Services GmbH"
      ]
    },
    {
      "created": "2026-04-24T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SE; asn=214503; asn_org=QuxLabs AB",
      "id": "indicator--b86c62ab-d569-4d2f-81dd-cb7d9dc63f99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T10:05:10.000Z",
      "valid_until": "2026-05-26T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T09:05:40.916Z",
      "x_nadsec_last_seen": "2026-04-24T09:05:40.916Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SE"
      ],
      "x_nadsec_asns": [
        "214503"
      ],
      "x_nadsec_orgs": [
        "QuxLabs AB"
      ]
    },
    {
      "created": "2026-04-24T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SE; asn=214503; asn_org=QuxLabs AB",
      "id": "indicator--5c983f85-df06-4a96-8761-4b37cd13e45e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T10:05:10.000Z",
      "valid_until": "2026-05-26T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T09:05:20.170Z",
      "x_nadsec_last_seen": "2026-04-24T09:05:20.170Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SE"
      ],
      "x_nadsec_asns": [
        "214503"
      ],
      "x_nadsec_orgs": [
        "QuxLabs AB"
      ]
    },
    {
      "created": "2026-04-24T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=NL; asn=214677; asn_org=DELUXHOST",
      "id": "indicator--3f7c466f-d8be-4bf4-a27b-16cd34de821e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.181.177.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T10:05:10.000Z",
      "valid_until": "2026-05-26T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T09:06:24.328Z",
      "x_nadsec_last_seen": "2026-04-24T09:06:25.011Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "214677"
      ],
      "x_nadsec_orgs": [
        "DELUXHOST"
      ]
    },
    {
      "created": "2026-04-24T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=NL; asn=214677; asn_org=DELUXHOST",
      "id": "indicator--b77c7464-3dce-4136-89f2-b439b5df1737",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.181.177.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T10:05:10.000Z",
      "valid_until": "2026-05-26T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T09:06:14.329Z",
      "x_nadsec_last_seen": "2026-04-24T09:06:14.329Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "214677"
      ],
      "x_nadsec_orgs": [
        "DELUXHOST"
      ]
    },
    {
      "created": "2026-04-24T11:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=52630; asn_org=MOTTANET TI - SERVICOS DE TECNOLOGIA DA INFO",
      "id": "indicator--8453d62e-c0b9-410d-bdd2-6756e34c7a61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T11:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '170.233.6.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T11:05:09.000Z",
      "valid_until": "2026-05-26T11:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-24T11:01:59.108Z",
      "x_nadsec_last_seen": "2026-04-24T11:02:13.706Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52630"
      ],
      "x_nadsec_orgs": [
        "MOTTANET TI - SERVICOS DE TECNOLOGIA DA INFO"
      ]
    },
    {
      "created": "2026-04-24T11:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--979fc355-bb49-4d84-83f4-1652bd4a1b89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T11:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '27.73.37.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T11:05:09.000Z",
      "valid_until": "2026-05-26T11:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T10:25:37.703Z",
      "x_nadsec_last_seen": "2026-04-24T10:29:56.782Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-24T11:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=15924; asn_org=Vodafone Net Iletisim Hizmetler AS",
      "id": "indicator--e8590e70-5ee4-4f07-ab5c-627cfe8522aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T11:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '81.8.21.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T11:05:09.000Z",
      "valid_until": "2026-05-26T11:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-24T10:57:43.697Z",
      "x_nadsec_last_seen": "2026-04-24T10:59:50.237Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "15924"
      ],
      "x_nadsec_orgs": [
        "Vodafone Net Iletisim Hizmetler AS"
      ]
    },
    {
      "created": "2026-04-24T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=KM; asn=328061; asn_org=TELCO-SA-AS",
      "id": "indicator--dfc04e02-c989-4de8-902b-1060906e7b5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.207.179.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T12:05:10.000Z",
      "valid_until": "2026-05-26T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T11:13:42.747Z",
      "x_nadsec_last_seen": "2026-04-24T11:13:42.747Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "KM"
      ],
      "x_nadsec_asns": [
        "328061"
      ],
      "x_nadsec_orgs": [
        "TELCO-SA-AS"
      ]
    },
    {
      "created": "2026-04-24T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--daaa072c-2690-4e9f-b8eb-1577adca143a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.65.148.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T12:05:10.000Z",
      "valid_until": "2026-05-26T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-24T11:37:55.261Z",
      "x_nadsec_last_seen": "2026-04-29T16:38:14.490Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-04-24T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--6cd6082d-5fbf-4d26-ac19-74ac8808d08f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T12:05:10.000Z",
      "valid_until": "2026-05-26T12:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-23T20:05:05.604Z",
      "x_nadsec_last_seen": "2026-04-24T11:19:19.021Z",
      "x_nadsec_ports": [
        "445",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-24T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=NL; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--04274522-5976-4e2f-b515-50abad22e929",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '80.82.77.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T12:05:10.000Z",
      "valid_until": "2026-05-26T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T11:33:14.996Z",
      "x_nadsec_last_seen": "2026-04-24T11:33:14.996Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-04-24T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--7f241d26-9aa4-4576-980e-54f358059221",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.118.225.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T13:05:10.000Z",
      "valid_until": "2026-05-26T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T12:21:19.282Z",
      "x_nadsec_last_seen": "2026-04-24T12:21:29.459Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-24T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b42b9c44-5a03-4a72-8dc7-6f982f3ddd66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.171.28.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T13:05:10.000Z",
      "valid_until": "2026-05-26T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T12:41:25.952Z",
      "x_nadsec_last_seen": "2026-04-24T12:41:26.237Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-24T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--2d29480d-9b07-4e86-9681-acd8558b7951",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.14.9.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T13:05:10.000Z",
      "valid_until": "2026-05-26T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T12:55:15.343Z",
      "x_nadsec_last_seen": "2026-04-24T12:55:15.343Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-24T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--51cf2278-250f-4219-afee-6e8ffcf38a61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.140.171.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T13:05:10.000Z",
      "valid_until": "2026-05-26T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T12:10:01.735Z",
      "x_nadsec_last_seen": "2026-04-24T12:10:01.735Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-24T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--1544737e-da62-47e2-b136-82f6293c345f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '95.9.130.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T13:05:10.000Z",
      "valid_until": "2026-05-26T13:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-24T12:11:48.513Z",
      "x_nadsec_last_seen": "2026-04-24T12:12:17.529Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-24T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mysqld; ports=3306; cc=NL; asn=136258; asn_org=BrainStorm Network, Inc",
      "id": "indicator--f82ad02b-c6cd-4fae-ae7c-54074221149b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '109.104.154.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T14:05:10.000Z",
      "valid_until": "2026-05-26T14:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-24T13:54:18.088Z",
      "x_nadsec_last_seen": "2026-04-25T09:10:08.448Z",
      "x_nadsec_ports": [
        "27017",
        "21",
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "mongod",
        "ftpd",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "136258"
      ],
      "x_nadsec_orgs": [
        "BrainStorm Network, Inc"
      ]
    },
    {
      "created": "2026-04-24T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MO; asn=4609; asn_org=Companhia de Telecomunicacoes de Macau SARL",
      "id": "indicator--8d85856d-0342-4259-bfdc-0cc89a9c93b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '122.100.156.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T14:05:10.000Z",
      "valid_until": "2026-05-26T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-24T13:15:51.157Z",
      "x_nadsec_last_seen": "2026-04-24T13:17:31.016Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MO"
      ],
      "x_nadsec_asns": [
        "4609"
      ],
      "x_nadsec_orgs": [
        "Companhia de Telecomunicacoes de Macau SARL"
      ]
    },
    {
      "created": "2026-04-24T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=131269; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--c4729ba5-2a9e-47e8-b500-5ee4ff1fd350",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '49.205.214.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T14:05:10.000Z",
      "valid_until": "2026-05-26T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T13:36:53.831Z",
      "x_nadsec_last_seen": "2026-04-24T13:36:53.831Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "131269"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-04-24T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--0e8d669f-be8a-4524-aa99-03b60d0dbd7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T14:05:10.000Z",
      "valid_until": "2026-05-26T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T13:47:36.440Z",
      "x_nadsec_last_seen": "2026-04-24T13:47:36.440Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-24T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=43403; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--2bf2acac-e486-436b-8ae1-86231e2ecc6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T14:05:10.000Z",
      "valid_until": "2026-05-26T14:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T13:43:34.542Z",
      "x_nadsec_last_seen": "2026-04-24T13:43:34.546Z",
      "x_nadsec_ports": [
        "42",
        "43403"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-24T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--7e46ee64-7c3c-4de1-8d6b-f9cef346ad8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.244.173.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T15:05:02.000Z",
      "valid_until": "2026-05-26T15:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T14:41:32.719Z",
      "x_nadsec_last_seen": "2026-04-24T14:41:43.980Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-24T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--1d7eade6-2d37-4bc7-8aba-9c97617cdc46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '159.223.109.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T15:05:02.000Z",
      "valid_until": "2026-05-26T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-24T14:41:45.230Z",
      "x_nadsec_last_seen": "2026-04-25T23:55:20.547Z",
      "x_nadsec_ports": [
        "1883",
        "1433",
        "27017"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-24T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=NL; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6d04cef0-c055-4eed-ad31-4c6e32258930",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '167.99.47.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T15:05:02.000Z",
      "valid_until": "2026-05-26T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T14:36:25.147Z",
      "x_nadsec_last_seen": "2026-04-24T14:36:25.147Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-24T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=DO; asn=266798; asn_org=UNE COMUNICACIONES SRL",
      "id": "indicator--b2f98a28-b56a-4ad9-8f92-5fb4ab968d91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.235.229.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T15:05:02.000Z",
      "valid_until": "2026-05-26T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T14:58:53.583Z",
      "x_nadsec_last_seen": "2026-04-24T14:58:53.583Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DO"
      ],
      "x_nadsec_asns": [
        "266798"
      ],
      "x_nadsec_orgs": [
        "UNE COMUNICACIONES SRL"
      ]
    },
    {
      "created": "2026-04-24T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=DO; asn=266798; asn_org=UNE COMUNICACIONES SRL",
      "id": "indicator--54fa8aaf-5d6d-42f9-9954-0762d4862ae5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.235.229.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T15:05:02.000Z",
      "valid_until": "2026-05-26T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T14:58:53.879Z",
      "x_nadsec_last_seen": "2026-04-24T14:58:53.879Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DO"
      ],
      "x_nadsec_asns": [
        "266798"
      ],
      "x_nadsec_orgs": [
        "UNE COMUNICACIONES SRL"
      ]
    },
    {
      "created": "2026-04-24T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--d2b38f77-975f-477c-8ee2-c6b9e95f9edb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.251.124.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T15:05:02.000Z",
      "valid_until": "2026-05-26T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T14:18:16.902Z",
      "x_nadsec_last_seen": "2026-04-24T14:18:16.902Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-24T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IL; asn=8551; asn_org=Bezeq International Ltd.",
      "id": "indicator--a3d460ad-b179-403b-96c1-004edf015021",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '62.219.1.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T15:05:02.000Z",
      "valid_until": "2026-05-26T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-24T15:00:31.731Z",
      "x_nadsec_last_seen": "2026-04-24T15:02:38.803Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IL"
      ],
      "x_nadsec_asns": [
        "8551"
      ],
      "x_nadsec_orgs": [
        "Bezeq International Ltd."
      ]
    },
    {
      "created": "2026-04-24T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--3681f207-72f7-46a1-917a-d8eaaa5af221",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T15:05:02.000Z",
      "valid_until": "2026-05-26T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T14:32:00.959Z",
      "x_nadsec_last_seen": "2026-04-24T14:32:00.959Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-24T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=12735; asn_org=TurkNet Iletisim Hizmetleri A.S.",
      "id": "indicator--413706d2-7031-4cba-a1b2-0ffdc9329cca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '159.146.54.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T16:05:10.000Z",
      "valid_until": "2026-05-26T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-24T15:45:33.297Z",
      "x_nadsec_last_seen": "2026-04-24T15:47:40.035Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "12735"
      ],
      "x_nadsec_orgs": [
        "TurkNet Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-04-24T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--ac0e57d6-de9b-4dfc-9a56-cd403111afa8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T16:05:10.000Z",
      "valid_until": "2026-05-26T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T15:27:10.738Z",
      "x_nadsec_last_seen": "2026-04-24T15:27:10.738Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-24T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--74564442-648c-448e-9cb9-4dcad34b44ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T16:05:10.000Z",
      "valid_until": "2026-05-26T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T15:46:29.695Z",
      "x_nadsec_last_seen": "2026-04-24T15:46:29.695Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-24T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=45815; asn_org=ESDS Software Solution Limited.; user(top)=**; pass(top)=1****6",
      "id": "indicator--293f06bd-fbd3-4208-9a48-f1e0849d9fe5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.249.213.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T16:05:10.000Z",
      "valid_until": "2026-05-26T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T15:42:17.069Z",
      "x_nadsec_last_seen": "2026-04-24T15:42:17.069Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45815"
      ],
      "x_nadsec_orgs": [
        "ESDS Software Solution Limited."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6"
      ]
    },
    {
      "created": "2026-04-24T17:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=httpd; ports=81; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--8415b343-f2ef-4a97-a46e-5ea8db751d4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T17:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.217.85.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T17:05:04.000Z",
      "valid_until": "2026-05-26T17:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-24T16:23:20.926Z",
      "x_nadsec_last_seen": "2026-04-24T16:30:52.818Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-24T17:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e438ee9b-e6cf-4075-89f9-f19034858dc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T17:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T17:05:04.000Z",
      "valid_until": "2026-05-26T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T17:03:49.317Z",
      "x_nadsec_last_seen": "2026-04-24T17:03:49.317Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-24T17:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--39ef9c9c-db64-4af1-beba-fa69caabdd47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T17:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T17:05:04.000Z",
      "valid_until": "2026-05-26T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T16:56:01.781Z",
      "x_nadsec_last_seen": "2026-04-24T16:56:01.781Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-24T17:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--cd6790a6-0047-4d6d-96c1-ddba46a55713",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T17:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T17:05:04.000Z",
      "valid_until": "2026-05-26T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T16:56:02.184Z",
      "x_nadsec_last_seen": "2026-04-24T16:56:02.184Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-24T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e5df51ab-cfe4-4417-abbc-683ce7316b25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.182.174.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T18:05:02.000Z",
      "valid_until": "2026-05-26T18:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T17:16:23.141Z",
      "x_nadsec_last_seen": "2026-04-24T17:16:23.159Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-24T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MA; asn=36925; asn_org=ASMedi",
      "id": "indicator--083ddb13-59d2-4163-9e31-db8f02869a17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.230.138.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T18:05:02.000Z",
      "valid_until": "2026-05-26T18:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-24T17:49:09.711Z",
      "x_nadsec_last_seen": "2026-04-24T17:56:14.674Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "36925"
      ],
      "x_nadsec_orgs": [
        "ASMedi"
      ]
    },
    {
      "created": "2026-04-24T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--c4143c81-ca52-4a5e-b429-ebc75490dbe6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T18:05:02.000Z",
      "valid_until": "2026-05-26T18:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T17:24:38.730Z",
      "x_nadsec_last_seen": "2026-04-24T17:24:38.730Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-24T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=MX; asn=11172; asn_org=Alestra, S. de R.L. de C.V.; user(top)=**",
      "id": "indicator--c30edf42-d9b2-459e-9ccb-953fc68570a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '200.52.113.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T18:05:02.000Z",
      "valid_until": "2026-05-26T18:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T17:24:14.262Z",
      "x_nadsec_last_seen": "2026-04-24T17:24:15.320Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "11172"
      ],
      "x_nadsec_orgs": [
        "Alestra, S. de R.L. de C.V."
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-24T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--3c80a12e-21c6-498d-8e1a-2e7a55723bb3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '206.189.207.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T18:05:02.000Z",
      "valid_until": "2026-05-26T18:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T17:16:21.415Z",
      "x_nadsec_last_seen": "2026-04-24T17:16:21.415Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-24T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=HK; asn=133752; asn_org=LEASEWEB HONG KONG LIMITED",
      "id": "indicator--3ae3efeb-3707-45f4-925e-6c7eabbf0fef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '27.0.232.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T18:05:02.000Z",
      "valid_until": "2026-05-26T18:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T17:52:59.014Z",
      "x_nadsec_last_seen": "2026-04-26T19:41:36.845Z",
      "x_nadsec_ports": [
        "21",
        "81"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "133752"
      ],
      "x_nadsec_orgs": [
        "LEASEWEB HONG KONG LIMITED"
      ]
    },
    {
      "created": "2026-04-24T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--ab67be14-11cf-42c0-877e-4df187a2fb60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.46.158.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T19:05:11.000Z",
      "valid_until": "2026-05-26T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-24T18:17:02.221Z",
      "x_nadsec_last_seen": "2026-04-24T18:19:08.991Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-24T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MA; asn=6713; asn_org=Itissalat Al-MAGHRIB; user(top)=**",
      "id": "indicator--90f9f90e-5233-485f-8fe5-55fe2e9cd5cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.206.225.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T19:05:11.000Z",
      "valid_until": "2026-05-26T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-09T19:06:47.654Z",
      "x_nadsec_last_seen": "2026-04-24T18:10:06.860Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "6713"
      ],
      "x_nadsec_orgs": [
        "Itissalat Al-MAGHRIB"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-24T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; user(top)=**",
      "id": "indicator--4e0b8a88-cfab-4f24-bbf5-328842534931",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '60.210.30.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T19:05:11.000Z",
      "valid_until": "2026-05-26T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T18:42:08.271Z",
      "x_nadsec_last_seen": "2026-04-24T18:42:08.271Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-24T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=ID; asn=4787; asn_org=PT Cyberindo Aditama",
      "id": "indicator--9acf926e-55e8-4b0d-bff0-f9f2b721f785",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.86.159.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T20:05:11.000Z",
      "valid_until": "2026-05-26T20:05:09.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-04-24T19:09:07.850Z",
      "x_nadsec_last_seen": "2026-04-26T18:46:59.188Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "4787"
      ],
      "x_nadsec_orgs": [
        "PT Cyberindo Aditama"
      ]
    },
    {
      "created": "2026-04-24T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--73d58da1-414f-4820-8a92-bd57d3775f9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '134.209.106.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T20:05:11.000Z",
      "valid_until": "2026-05-26T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T19:22:44.844Z",
      "x_nadsec_last_seen": "2026-04-24T19:22:44.844Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-24T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--2cc25fc8-1e08-4afe-aae9-afa3a7010ea0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.198.200.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T20:05:11.000Z",
      "valid_until": "2026-05-26T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T19:41:07.226Z",
      "x_nadsec_last_seen": "2026-04-24T19:41:07.226Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-24T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ccd8ba0b-5e0d-4add-8ad0-48c800a8df55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.124.176.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T20:05:11.000Z",
      "valid_until": "2026-05-26T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T19:29:53.581Z",
      "x_nadsec_last_seen": "2026-04-24T19:30:03.901Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-24T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TN; asn=37671; asn_org=GLOBALNET-AS",
      "id": "indicator--c9f27484-8408-4522-adcc-28cb921c6230",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.225.16.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T20:05:11.000Z",
      "valid_until": "2026-05-26T20:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-24T19:19:14.973Z",
      "x_nadsec_last_seen": "2026-04-24T19:27:06.423Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37671"
      ],
      "x_nadsec_orgs": [
        "GLOBALNET-AS"
      ]
    },
    {
      "created": "2026-04-24T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ES; asn=3352; asn_org=Telefonica De Espana S.a.u.",
      "id": "indicator--e3fb84f7-a596-4ae6-8da5-fc038eb1b209",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '81.40.7.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T20:05:11.000Z",
      "valid_until": "2026-05-26T20:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-24T19:08:25.737Z",
      "x_nadsec_last_seen": "2026-04-24T19:09:09.397Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "3352"
      ],
      "x_nadsec_orgs": [
        "Telefonica De Espana S.a.u."
      ]
    },
    {
      "created": "2026-04-24T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e2ccb2be-4baf-41c7-8e56-9fa77b837f96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.222.40.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T21:05:10.000Z",
      "valid_until": "2026-05-26T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T20:06:15.348Z",
      "x_nadsec_last_seen": "2026-04-24T20:06:15.348Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-24T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--51e9c7db-7b4b-45b0-bb82-6b09c5a8a6d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.202.118.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T21:05:10.000Z",
      "valid_until": "2026-05-26T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T20:25:43.193Z",
      "x_nadsec_last_seen": "2026-04-24T20:25:43.193Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-24T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MX; asn=262916; asn_org=Mega Cable, S.A. de C.V.; user(top)=**",
      "id": "indicator--2ffa8a87-ae98-40bc-9db8-0ae66804db01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '201.132.11.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T21:05:10.000Z",
      "valid_until": "2026-05-26T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T21:01:10.174Z",
      "x_nadsec_last_seen": "2026-04-24T21:01:10.174Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "262916"
      ],
      "x_nadsec_orgs": [
        "Mega Cable, S.A. de C.V."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-24T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=SG; asn=9506; asn_org=Singtel Fibre Broadband",
      "id": "indicator--b03d72c2-bd0f-4b19-88f4-96243f398778",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '219.74.127.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T21:05:10.000Z",
      "valid_until": "2026-05-26T21:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-24T20:16:43.497Z",
      "x_nadsec_last_seen": "2026-04-24T20:22:51.252Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "9506"
      ],
      "x_nadsec_orgs": [
        "Singtel Fibre Broadband"
      ]
    },
    {
      "created": "2026-04-24T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GE; asn=29289; asn_org=Georgian Technical University",
      "id": "indicator--70dd3e90-0065-4b98-8390-ac77a4f66630",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '109.205.46.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T22:05:02.000Z",
      "valid_until": "2026-05-26T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-24T21:08:01.670Z",
      "x_nadsec_last_seen": "2026-04-24T21:10:08.215Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "29289"
      ],
      "x_nadsec_orgs": [
        "Georgian Technical University"
      ]
    },
    {
      "created": "2026-04-24T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=epmapper; ports=135; cc=ZA; asn=37358; asn_org=BITCO",
      "id": "indicator--41dab730-5461-4efa-b3bd-1de85aa27e66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.117.149.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T22:05:02.000Z",
      "valid_until": "2026-05-26T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-24T21:55:04.493Z",
      "x_nadsec_last_seen": "2026-04-24T21:55:06.748Z",
      "x_nadsec_ports": [
        "135",
        "445"
      ],
      "x_nadsec_services": [
        "epmapper",
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "37358"
      ],
      "x_nadsec_orgs": [
        "BITCO"
      ]
    },
    {
      "created": "2026-04-24T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=ftpd; ports=21; cc=AU; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--a74d0342-24ca-4af1-a5be-637797dd8680",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.236.35.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T22:05:02.000Z",
      "valid_until": "2026-05-26T22:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-24T21:49:08.954Z",
      "x_nadsec_last_seen": "2026-04-24T21:49:49.593Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-24T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IQ; asn=206206; asn_org=Kurdistan Net Company for Computer and Internet Ltd.",
      "id": "indicator--7344e890-d989-4542-9325-c1ec420ff437",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.136.151.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T22:05:02.000Z",
      "valid_until": "2026-05-26T22:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T22:03:35.138Z",
      "x_nadsec_last_seen": "2026-04-24T22:03:36.205Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IQ"
      ],
      "x_nadsec_asns": [
        "206206"
      ],
      "x_nadsec_orgs": [
        "Kurdistan Net Company for Computer and Internet Ltd."
      ]
    },
    {
      "created": "2026-04-24T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--bf1982a2-68f5-4451-ac53-9b4898247edf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.102.116.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T22:05:02.000Z",
      "valid_until": "2026-05-26T22:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T21:35:37.061Z",
      "x_nadsec_last_seen": "2026-04-24T21:35:37.061Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-24T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b058af58-fff6-4740-9949-c0e89663e8dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.168.0.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T22:05:02.000Z",
      "valid_until": "2026-05-26T22:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T21:42:08.313Z",
      "x_nadsec_last_seen": "2026-04-24T21:42:08.313Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-24T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--afac38ff-dfa2-4404-adc9-1f9c103b083e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '27.49.56.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T22:05:02.000Z",
      "valid_until": "2026-05-26T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-24T21:17:08.496Z",
      "x_nadsec_last_seen": "2026-04-24T21:19:12.883Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-04-24T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=17488; asn_org=Hathway IP Over Cable Internet",
      "id": "indicator--a62f79a9-cc0c-40a9-a689-cc4920d4ce0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '60.243.116.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T22:05:02.000Z",
      "valid_until": "2026-05-26T22:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T21:28:59.356Z",
      "x_nadsec_last_seen": "2026-04-24T21:28:59.497Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17488"
      ],
      "x_nadsec_orgs": [
        "Hathway IP Over Cable Internet"
      ]
    },
    {
      "created": "2026-04-24T23:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--ce75ad0f-4c8c-4b8e-a699-5e01d3db25f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T23:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '125.235.235.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T23:05:14.000Z",
      "valid_until": "2026-05-26T23:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-24T22:20:18.588Z",
      "x_nadsec_last_seen": "2026-04-24T22:22:23.173Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-24T23:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--b4aafb16-ee19-4705-a2d8-7950a59fb992",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T23:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T23:05:14.000Z",
      "valid_until": "2026-05-26T23:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T22:35:45.719Z",
      "x_nadsec_last_seen": "2026-04-24T22:35:45.719Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-24T23:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8d48bd37-a962-41fd-89d7-5ce020fbb87b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T23:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.102.92.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T23:05:14.000Z",
      "valid_until": "2026-05-26T23:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T23:03:27.839Z",
      "x_nadsec_last_seen": "2026-04-24T23:03:28.623Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-24T23:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--584cf865-d0e0-4d3c-9329-d0860fbc0f82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T23:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.171.9.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T23:05:14.000Z",
      "valid_until": "2026-05-26T23:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T22:48:58.565Z",
      "x_nadsec_last_seen": "2026-04-24T22:49:08.710Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-25T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=28458; asn_org=IENTC S DE RL DE CV",
      "id": "indicator--4cd76e63-11d2-4ade-81d3-505763d514cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '156.252.12.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T00:05:02.000Z",
      "valid_until": "2026-05-27T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-24T23:15:42.954Z",
      "x_nadsec_last_seen": "2026-04-24T23:17:48.356Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "28458"
      ],
      "x_nadsec_orgs": [
        "IENTC S DE RL DE CV"
      ]
    },
    {
      "created": "2026-04-25T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=LU; asn=214472; asn_org=Offshore LC",
      "id": "indicator--81012e04-51f5-411b-afe9-68b78baf33cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T00:05:02.000Z",
      "valid_until": "2026-05-27T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T23:15:41.889Z",
      "x_nadsec_last_seen": "2026-04-24T23:15:41.889Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "LU"
      ],
      "x_nadsec_asns": [
        "214472"
      ],
      "x_nadsec_orgs": [
        "Offshore LC"
      ]
    },
    {
      "created": "2026-04-25T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--3399c6a8-aa02-4dd1-a8ef-0cd04ae0abe7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T00:05:02.000Z",
      "valid_until": "2026-05-27T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T23:22:01.163Z",
      "x_nadsec_last_seen": "2026-04-24T23:22:01.163Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-25T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c3d9d477-7d44-4e1d-9d88-5bf685a9e2f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.124.170.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T00:05:02.000Z",
      "valid_until": "2026-05-27T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T23:22:19.748Z",
      "x_nadsec_last_seen": "2026-04-24T23:22:29.910Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-25T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=SA; asn=35819; asn_org=Etihad Etisalat, a joint stock company; user(top)=**",
      "id": "indicator--045d00ae-341a-4c3a-8f58-751692e8cb06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.152.25.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T00:05:02.000Z",
      "valid_until": "2026-05-27T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-24T23:41:37.865Z",
      "x_nadsec_last_seen": "2026-04-24T23:41:39.376Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "35819"
      ],
      "x_nadsec_orgs": [
        "Etihad Etisalat, a joint stock company"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-25T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--2f0d5dff-2d01-448b-82ab-967bed2f80cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T00:05:02.000Z",
      "valid_until": "2026-05-27T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-24T23:09:03.244Z",
      "x_nadsec_last_seen": "2026-04-24T23:09:03.244Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-25T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=GR; asn=6799; asn_org=OTEnet S.A.",
      "id": "indicator--8b39daec-038b-4f24-9a5e-9be3430e2d16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.170.16.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T01:05:10.000Z",
      "valid_until": "2026-05-27T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-25T01:01:04.786Z",
      "x_nadsec_last_seen": "2026-04-25T01:12:05.572Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GR"
      ],
      "x_nadsec_asns": [
        "6799"
      ],
      "x_nadsec_orgs": [
        "OTEnet S.A."
      ]
    },
    {
      "created": "2026-04-25T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--dfb2ce64-9c9b-48dd-bfe0-987a3444b358",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '44.203.252.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T01:05:10.000Z",
      "valid_until": "2026-05-27T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-25T00:55:26.360Z",
      "x_nadsec_last_seen": "2026-04-25T00:55:26.360Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-25T02:05:24.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--1be6c704-432d-4006-a0fd-3d67788b011a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T02:05:24.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '112.31.16.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T02:05:24.000Z",
      "valid_until": "2026-05-27T02:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-25T02:00:01.582Z",
      "x_nadsec_last_seen": "2026-04-25T06:26:33.879Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-04-25T02:05:24.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6cb93448-e7fe-4497-90ca-09aaab290332",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T02:05:24.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T02:05:24.000Z",
      "valid_until": "2026-05-27T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-25T02:04:08.651Z",
      "x_nadsec_last_seen": "2026-04-25T02:04:08.651Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-25T02:05:24.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--92fc8d7b-d14a-4950-86a2-877941aae8c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T02:05:24.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '171.250.187.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T02:05:24.000Z",
      "valid_until": "2026-05-27T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-25T01:28:30.451Z",
      "x_nadsec_last_seen": "2026-04-25T01:28:35.263Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-25T02:05:24.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--7eac6ad8-a767-461a-821c-0c57dcd36192",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T02:05:24.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T02:05:24.000Z",
      "valid_until": "2026-05-27T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-25T01:37:03.336Z",
      "x_nadsec_last_seen": "2026-04-25T01:37:03.336Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-25T03:05:50.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--4c5c7fab-5894-4467-9a9f-ad0c3c094e9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T03:05:50.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.19.78.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T03:05:50.000Z",
      "valid_until": "2026-05-27T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-25T02:32:32.000Z",
      "x_nadsec_last_seen": "2026-04-25T02:32:32.000Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-04-25T03:05:50.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--1d8e2ceb-373c-4501-8ce9-fae781479898",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T03:05:50.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '13.89.124.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T03:05:50.000Z",
      "valid_until": "2026-05-27T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-25T02:40:05.458Z",
      "x_nadsec_last_seen": "2026-04-25T02:40:05.458Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-25T03:05:50.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--9964b9db-2aac-4492-ae0a-9113b3f7c74d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T03:05:50.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.168.121.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T03:05:50.000Z",
      "valid_until": "2026-05-27T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-25T02:57:25.228Z",
      "x_nadsec_last_seen": "2026-04-25T02:57:25.228Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-25T03:05:50.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AM; asn=44395; asn_org=Ucom CJSC",
      "id": "indicator--00321099-af7d-4ff5-a15b-1a0208a9d736",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T03:05:50.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '212.34.246.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T03:05:50.000Z",
      "valid_until": "2026-05-27T03:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-25T02:57:41.447Z",
      "x_nadsec_last_seen": "2026-04-25T03:05:53.894Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "44395"
      ],
      "x_nadsec_orgs": [
        "Ucom CJSC"
      ]
    },
    {
      "created": "2026-04-25T04:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BR; asn=28343; asn_org=UNIFIQUE TELECOMUNICACOES SA",
      "id": "indicator--8ad4c4b9-2478-4d98-b3ab-58704b32571e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T04:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.251.109.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T04:05:08.000Z",
      "valid_until": "2026-05-27T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-25T03:46:33.162Z",
      "x_nadsec_last_seen": "2026-04-25T03:46:36.862Z",
      "x_nadsec_ports": [
        "21",
        "445"
      ],
      "x_nadsec_services": [
        "ftpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28343"
      ],
      "x_nadsec_orgs": [
        "UNIFIQUE TELECOMUNICACOES SA"
      ]
    },
    {
      "created": "2026-04-25T04:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e693c94d-193d-4b32-a1dc-d960de8ef719",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T04:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.199.83.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T04:05:08.000Z",
      "valid_until": "2026-05-27T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-25T03:47:14.398Z",
      "x_nadsec_last_seen": "2026-04-25T03:47:14.398Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-25T04:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BD; asn=9832; asn_org=ISN, Internet Service Provider; user(top)=**",
      "id": "indicator--9afd1667-4660-496f-82d6-2c332e493908",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T04:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '203.188.241.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T04:05:08.000Z",
      "valid_until": "2026-05-27T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-25T03:15:28.650Z",
      "x_nadsec_last_seen": "2026-04-28T07:00:36.099Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "9832"
      ],
      "x_nadsec_orgs": [
        "ISN, Internet Service Provider"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-25T04:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--abf0b2de-4276-4acb-8fcd-76b0d3db58de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T04:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T04:05:08.000Z",
      "valid_until": "2026-05-27T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-02T21:24:16.767Z",
      "x_nadsec_last_seen": "2026-04-25T03:44:25.879Z",
      "x_nadsec_ports": [
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-25T04:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--57cfdee9-ed23-4933-8589-70161550e78e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T04:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '58.186.8.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T04:05:08.000Z",
      "valid_until": "2026-05-27T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-25T03:05:17.730Z",
      "x_nadsec_last_seen": "2026-04-25T03:05:21.027Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-04-25T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=PK; asn=45773; asn_org=PERN AS Content Servie Provider, Islamabad, Pakistan",
      "id": "indicator--95798fc2-a0ee-48cb-afbf-ff7e72ad7985",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '121.52.153.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T05:05:10.000Z",
      "valid_until": "2026-05-27T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-25T04:48:41.505Z",
      "x_nadsec_last_seen": "2026-04-30T11:05:20.961Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "45773"
      ],
      "x_nadsec_orgs": [
        "PERN AS Content Servie Provider, Islamabad, Pakistan"
      ]
    },
    {
      "created": "2026-04-25T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--6a8dc450-6019-4e05-b228-6adb3a9e0f5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.119.106.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T05:05:10.000Z",
      "valid_until": "2026-05-27T05:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-25T04:55:19.480Z",
      "x_nadsec_last_seen": "2026-04-25T04:55:20.186Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-25T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a0c88e4d-8fff-4e61-be62-3b19e99d7cf6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T05:05:10.000Z",
      "valid_until": "2026-05-27T05:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-25T04:08:30.820Z",
      "x_nadsec_last_seen": "2026-04-25T04:08:32.004Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-25T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--d99e8b08-4851-437d-96c5-d90053ab4ce8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.245.131.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T05:05:10.000Z",
      "valid_until": "2026-05-27T05:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-25T05:02:10.061Z",
      "x_nadsec_last_seen": "2026-04-25T05:02:34.272Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-25T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--32c1eed6-1671-418c-afde-ac764fb49c2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T06:05:10.000Z",
      "valid_until": "2026-05-27T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-25T05:21:11.890Z",
      "x_nadsec_last_seen": "2026-04-30T20:37:48.124Z",
      "x_nadsec_ports": [
        "1883",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-25T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--22b71cea-eab8-4c70-ac77-a0cf9b284a18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.228.53.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T06:05:10.000Z",
      "valid_until": "2026-05-27T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-25T05:57:24.125Z",
      "x_nadsec_last_seen": "2026-04-27T02:37:47.871Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-25T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=8492; asn_org=OBIT Ltd.",
      "id": "indicator--5839c0ce-2f38-4cd2-9db1-1355688503ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '95.161.233.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T06:05:10.000Z",
      "valid_until": "2026-05-27T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-25T05:37:50.146Z",
      "x_nadsec_last_seen": "2026-04-25T05:44:09.446Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8492"
      ],
      "x_nadsec_orgs": [
        "OBIT Ltd."
      ]
    },
    {
      "created": "2026-04-25T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--7cb217a2-6b95-4e16-8d0b-66e6c62a8ad5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '116.96.78.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T07:05:02.000Z",
      "valid_until": "2026-05-27T07:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-25T07:01:58.915Z",
      "x_nadsec_last_seen": "2026-04-25T07:04:04.029Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-25T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--95686819-4241-4c84-8f38-668033fffb8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.224.163.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T07:05:02.000Z",
      "valid_until": "2026-05-27T07:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-25T06:44:15.709Z",
      "x_nadsec_last_seen": "2026-04-25T06:50:50.373Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-25T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--d8823cba-f962-44d8-82f0-163892b8b968",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.180.141.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T07:05:02.000Z",
      "valid_until": "2026-05-27T07:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-25T06:38:50.277Z",
      "x_nadsec_last_seen": "2026-04-25T06:38:50.277Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-04-25T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--efd1de54-9887-4663-ac64-0878b0610ecd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.163.30.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T07:05:02.000Z",
      "valid_until": "2026-05-27T07:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-25T06:18:40.532Z",
      "x_nadsec_last_seen": "2026-04-25T06:18:40.532Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-25T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f1309e7f-6588-4510-a436-180f00835cc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.227.53.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T07:05:02.000Z",
      "valid_until": "2026-05-27T07:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-25T06:51:44.411Z",
      "x_nadsec_last_seen": "2026-04-25T06:51:44.712Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-25T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--6966cb33-49cb-49e7-9e05-f22c8a823dea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T07:05:02.000Z",
      "valid_until": "2026-05-27T07:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-25T06:31:10.268Z",
      "x_nadsec_last_seen": "2026-04-25T06:31:10.268Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-25T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--aff5d135-8371-4b9d-8ac6-7f1e735e7f49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.224.181.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T08:05:03.000Z",
      "valid_until": "2026-05-27T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-25T07:57:42.052Z",
      "x_nadsec_last_seen": "2026-04-25T07:59:47.268Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-25T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--5b3a44a7-c8e3-4c06-81f8-eabb75944d8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.228.100.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T08:05:03.000Z",
      "valid_until": "2026-05-27T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-25T07:51:15.248Z",
      "x_nadsec_last_seen": "2026-04-25T07:51:20.110Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-25T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--43ae2043-16e7-43ed-8902-7099a9b99f62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.150.37.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T08:05:03.000Z",
      "valid_until": "2026-05-27T08:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-25T07:45:53.723Z",
      "x_nadsec_last_seen": "2026-04-25T07:45:53.763Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-04-25T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=150008; asn_org=Pioneer Elabs Ltd.",
      "id": "indicator--d23e4ee5-a0a1-4201-8e38-4c4aab0d9845",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '202.65.148.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T08:05:03.000Z",
      "valid_until": "2026-05-27T08:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-25T08:01:57.234Z",
      "x_nadsec_last_seen": "2026-04-25T08:04:01.190Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "150008"
      ],
      "x_nadsec_orgs": [
        "Pioneer Elabs Ltd."
      ]
    },
    {
      "created": "2026-04-25T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--4e245947-8b52-442e-92b0-fe3a2348e9cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.79.172.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T09:05:02.000Z",
      "valid_until": "2026-05-27T09:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-25T08:40:21.857Z",
      "x_nadsec_last_seen": "2026-04-25T08:40:51.857Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-25T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--f640bf6c-b12c-46bd-a500-4d1cbf62d9b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '52.21.227.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T09:05:02.000Z",
      "valid_until": "2026-05-27T09:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-25T08:35:40.785Z",
      "x_nadsec_last_seen": "2026-04-25T08:35:40.785Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-25T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--260c2ca0-0dfd-4761-be75-0b305b8c648b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '101.36.108.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T10:05:02.000Z",
      "valid_until": "2026-05-27T10:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-25T09:25:21.253Z",
      "x_nadsec_last_seen": "2026-04-25T09:25:53.801Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-25T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=ZA; asn=327750; asn_org=JENNY-INTERNET",
      "id": "indicator--c2fc0c94-7e3e-4c8a-9ca9-32bd16b790ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.126.208.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T10:05:02.000Z",
      "valid_until": "2026-05-27T10:05:01.000Z",
      "x_nadsec_event_count": 3151,
      "x_nadsec_first_seen": "2026-04-25T09:19:31.975Z",
      "x_nadsec_last_seen": "2026-04-25T20:32:16.435Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "327750"
      ],
      "x_nadsec_orgs": [
        "JENNY-INTERNET"
      ]
    },
    {
      "created": "2026-04-25T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--fe667b37-9c4b-46b7-927b-5f14f1fe2c70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.11.183.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T10:05:02.000Z",
      "valid_until": "2026-05-27T10:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-25T09:10:36.405Z",
      "x_nadsec_last_seen": "2026-04-25T09:11:00.374Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-25T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--3335b472-d097-4134-9a1b-5438b7a4582d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T10:05:02.000Z",
      "valid_until": "2026-05-27T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-25T09:33:47.304Z",
      "x_nadsec_last_seen": "2026-04-25T09:33:47.304Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-25T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--e7e26056-6230-4807-8535-a6b17f64c441",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T10:05:02.000Z",
      "valid_until": "2026-05-27T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-25T09:30:40.839Z",
      "x_nadsec_last_seen": "2026-04-25T09:30:40.839Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-25T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--d02922b4-c21b-4fe7-a5a4-db1e876663fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '156.207.144.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T11:05:10.000Z",
      "valid_until": "2026-05-27T11:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-25T10:11:14.548Z",
      "x_nadsec_last_seen": "2026-04-25T10:18:13.219Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-25T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--047d1dca-00ac-4558-8fd2-c59b99572926",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '213.14.127.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T11:05:10.000Z",
      "valid_until": "2026-05-27T11:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-25T10:44:14.595Z",
      "x_nadsec_last_seen": "2026-04-25T10:46:21.231Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-04-25T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--8540d6b5-7e6e-4395-b1fc-b4501acb74f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.236.169.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T11:05:10.000Z",
      "valid_until": "2026-05-27T11:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-25T10:23:07.928Z",
      "x_nadsec_last_seen": "2026-04-25T10:23:07.928Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-25T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--2fe8116d-7234-47ec-a46c-34181a91868e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.141.88.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T11:05:10.000Z",
      "valid_until": "2026-05-27T11:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-25T11:00:07.658Z",
      "x_nadsec_last_seen": "2026-04-25T11:07:54.733Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-25T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--e6908519-a9c0-475b-aefa-404877867c12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.89.43.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T12:05:11.000Z",
      "valid_until": "2026-05-27T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-25T12:03:01.651Z",
      "x_nadsec_last_seen": "2026-04-25T12:05:09.492Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-04-25T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--45bf1fe4-b63f-47fd-aa5b-d07a32f139db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T12:05:11.000Z",
      "valid_until": "2026-05-27T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-11T15:35:06.603Z",
      "x_nadsec_last_seen": "2026-04-30T12:34:00.345Z",
      "x_nadsec_ports": [
        "445",
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-25T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=22; services=mssqld; ports=1433; cc=SC; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--ddf341ab-b265-4e44-99b3-6d29268fe495",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T13:05:02.000Z",
      "valid_until": "2026-05-27T13:05:00.000Z",
      "x_nadsec_event_count": 28,
      "x_nadsec_first_seen": "2026-04-25T12:45:47.271Z",
      "x_nadsec_last_seen": "2026-04-25T13:17:12.508Z",
      "x_nadsec_ports": [
        "81",
        "135",
        "1433",
        "1723",
        "1883",
        "27017",
        "21",
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "pptpd",
        "ftpd",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-04-25T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--9c78c980-1711-452b-a613-dd7ca120ab19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '52.248.43.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T13:05:02.000Z",
      "valid_until": "2026-05-27T13:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-25T12:13:31.994Z",
      "x_nadsec_last_seen": "2026-04-25T12:13:32.328Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-25T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--991a62ef-55bf-4669-9c44-1727ce641f1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T13:05:02.000Z",
      "valid_until": "2026-05-27T13:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-25T12:08:14.473Z",
      "x_nadsec_last_seen": "2026-04-25T12:08:14.473Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-25T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TN; asn=37705; asn_org=TOPNET; user(top)=**",
      "id": "indicator--ee7315c9-17cc-46a9-a458-8977b6d332ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.157.162.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T14:05:03.000Z",
      "valid_until": "2026-05-27T14:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-25T13:36:56.606Z",
      "x_nadsec_last_seen": "2026-04-25T13:36:56.606Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37705"
      ],
      "x_nadsec_orgs": [
        "TOPNET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-25T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--d5cb314a-cb1f-4c33-ad38-1a3b46348b38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.229.84.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T14:05:03.000Z",
      "valid_until": "2026-05-27T14:05:00.000Z",
      "x_nadsec_event_count": 3148,
      "x_nadsec_first_seen": "2026-04-25T13:15:08.576Z",
      "x_nadsec_last_seen": "2026-04-26T01:23:13.496Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-25T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=GB; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--ebc07da0-73dd-4101-b86c-af43d3e001ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.129.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T14:05:03.000Z",
      "valid_until": "2026-05-27T14:05:00.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-25T13:58:48.153Z",
      "x_nadsec_last_seen": "2026-04-25T13:59:33.837Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-25T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=ZA; asn=36994; asn_org=Vodacom-VB; user(top)=**",
      "id": "indicator--3f690731-00d5-4a1e-873a-f854d200c5cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.25.40.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T14:05:03.000Z",
      "valid_until": "2026-05-27T14:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-25T13:12:40.747Z",
      "x_nadsec_last_seen": "2026-04-28T22:04:45.903Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "36994"
      ],
      "x_nadsec_orgs": [
        "Vodacom-VB"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-25T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=36352; asn_org=HostPapa",
      "id": "indicator--09ca6eb0-005b-473d-8e9f-618fd17e4f29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '107.174.52.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T15:05:02.000Z",
      "valid_until": "2026-05-27T15:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-25T14:23:05.745Z",
      "x_nadsec_last_seen": "2026-04-25T14:23:05.745Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "36352"
      ],
      "x_nadsec_orgs": [
        "HostPapa"
      ]
    },
    {
      "created": "2026-04-25T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--de60ef2e-d01f-427c-a7b2-69a3f222857f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '119.147.84.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T15:05:02.000Z",
      "valid_until": "2026-05-27T15:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-25T14:41:43.858Z",
      "x_nadsec_last_seen": "2026-04-25T15:02:12.781Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-25T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=18881; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--9f9c8b0a-0750-471e-aad3-1a5d4a173d2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '177.96.228.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T15:05:02.000Z",
      "valid_until": "2026-05-27T15:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-25T14:41:48.984Z",
      "x_nadsec_last_seen": "2026-04-25T14:43:56.382Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "18881"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-04-25T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=ES; asn=41608; asn_org=NextGenWebs, S.L.",
      "id": "indicator--0e099b7f-eb18-41dd-8365-dd040ba06cd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.213.175.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T15:05:02.000Z",
      "valid_until": "2026-05-27T15:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-25T14:14:57.859Z",
      "x_nadsec_last_seen": "2026-04-25T14:14:57.864Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "41608"
      ],
      "x_nadsec_orgs": [
        "NextGenWebs, S.L."
      ]
    },
    {
      "created": "2026-04-25T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--9ff86c57-bfc9-4999-a987-16c353255f9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '213.74.213.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T15:05:02.000Z",
      "valid_until": "2026-05-27T15:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-25T14:30:29.997Z",
      "x_nadsec_last_seen": "2026-04-25T14:32:36.753Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-04-25T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--9d15ab2d-ce4f-47a4-9ded-0272099da169",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T15:05:02.000Z",
      "valid_until": "2026-05-27T15:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-25T14:34:39.281Z",
      "x_nadsec_last_seen": "2026-04-25T14:34:39.281Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-04-25T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--938362a6-7635-433b-a348-eefe0e22b1c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '114.35.52.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T16:05:10.000Z",
      "valid_until": "2026-05-27T16:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-25T15:16:09.878Z",
      "x_nadsec_last_seen": "2026-04-25T15:16:09.930Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-25T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--ab164e4c-0160-4159-b2c6-eb06fff43ba2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '148.230.208.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T16:05:10.000Z",
      "valid_until": "2026-05-27T16:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-25T15:11:07.108Z",
      "x_nadsec_last_seen": "2026-04-25T15:13:12.409Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-04-25T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--d728544f-64d8-4216-9b70-8007aa233bc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '187.188.193.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T16:05:10.000Z",
      "valid_until": "2026-05-27T16:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-25T15:11:06.857Z",
      "x_nadsec_last_seen": "2026-04-25T15:13:11.336Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-04-25T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation; user(top)=**",
      "id": "indicator--be6d430f-d03e-427e-86f4-e990aeb6c581",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.121.49.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T16:05:10.000Z",
      "valid_until": "2026-05-27T16:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-25T15:57:30.150Z",
      "x_nadsec_last_seen": "2026-04-27T18:07:27.536Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-25T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=16509; asn_org=Amazon.com, Inc.; user(top)=**",
      "id": "indicator--b90f2bbd-b6e6-474a-a4f1-ee11824abfa1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.108.167.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T16:05:10.000Z",
      "valid_until": "2026-05-27T16:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-25T15:50:46.844Z",
      "x_nadsec_last_seen": "2026-04-25T15:50:46.844Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-25T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--10aa154c-d001-447c-9ce3-cf02fc2eed6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '183.17.235.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T17:05:11.000Z",
      "valid_until": "2026-05-27T17:05:10.000Z",
      "x_nadsec_event_count": 6013,
      "x_nadsec_first_seen": "2026-04-25T16:20:30.716Z",
      "x_nadsec_last_seen": "2026-04-28T15:59:33.023Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-25T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--ee864d71-0bba-4ca1-aed6-b2a63ac34527",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T17:05:11.000Z",
      "valid_until": "2026-05-27T17:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-25T16:36:11.216Z",
      "x_nadsec_last_seen": "2026-04-25T16:36:11.216Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-25T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--77d0cf38-52d3-46a6-bb09-28cc3758c805",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T17:05:11.000Z",
      "valid_until": "2026-05-27T17:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-25T16:23:13.344Z",
      "x_nadsec_last_seen": "2026-04-27T15:55:15.650Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-25T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AZ; asn=31721; asn_org=Azercell Telecom Ltd",
      "id": "indicator--02ca99fc-14ec-464f-af39-73af8ce5d21a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '62.217.139.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T17:05:11.000Z",
      "valid_until": "2026-05-27T17:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-25T16:15:14.770Z",
      "x_nadsec_last_seen": "2026-04-25T16:23:18.629Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "31721"
      ],
      "x_nadsec_orgs": [
        "Azercell Telecom Ltd"
      ]
    },
    {
      "created": "2026-04-25T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--8931c6f2-1806-4d05-9b20-d8b1c53761a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T17:05:11.000Z",
      "valid_until": "2026-05-27T17:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-25T16:34:19.006Z",
      "x_nadsec_last_seen": "2026-04-25T16:34:19.006Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-25T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mysqld; ports=3306; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--ce0bef0a-b901-48a5-890f-1634a488bb68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '78.189.78.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T17:05:11.000Z",
      "valid_until": "2026-05-27T17:05:10.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-04-25T16:08:34.258Z",
      "x_nadsec_last_seen": "2026-04-25T16:08:37.310Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-25T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=63878; asn_org=PT Victory Network Indonesia",
      "id": "indicator--cffde995-8b92-4157-9b1a-653c91f34f4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.236.191.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T19:05:03.000Z",
      "valid_until": "2026-05-27T19:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-25T18:14:07.814Z",
      "x_nadsec_last_seen": "2026-04-25T19:16:11.924Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "63878"
      ],
      "x_nadsec_orgs": [
        "PT Victory Network Indonesia"
      ]
    },
    {
      "created": "2026-04-25T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=42595; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--900a1b90-c38f-41b9-bb28-a0eef43e905b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T19:05:03.000Z",
      "valid_until": "2026-05-27T19:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-25T18:10:42.798Z",
      "x_nadsec_last_seen": "2026-04-25T18:10:42.802Z",
      "x_nadsec_ports": [
        "42",
        "42595"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-25T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=45981; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--9f861523-2311-4539-97b1-8ea63f4e4dcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T19:05:03.000Z",
      "valid_until": "2026-05-27T19:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-25T18:10:43.580Z",
      "x_nadsec_last_seen": "2026-04-25T18:10:43.583Z",
      "x_nadsec_ports": [
        "42",
        "45981"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-25T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f10c4a72-e9aa-47e7-8fad-6c23ac00f5aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.22.218.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T20:05:03.000Z",
      "valid_until": "2026-05-27T20:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-25T19:46:10.036Z",
      "x_nadsec_last_seen": "2026-04-25T19:46:10.036Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-25T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--19de1256-7c4f-4ff3-a87b-a7fe046760b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.97.19.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T20:05:03.000Z",
      "valid_until": "2026-05-27T20:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-25T19:11:18.268Z",
      "x_nadsec_last_seen": "2026-04-25T19:11:18.268Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-25T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--8772296a-bb9d-4053-90c7-94820e749fa5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T20:05:03.000Z",
      "valid_until": "2026-05-27T20:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-25T19:23:14.894Z",
      "x_nadsec_last_seen": "2026-04-25T19:23:14.894Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-25T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12958; asn_org=T2 Mobile LLC",
      "id": "indicator--0781f449-460a-4815-9243-5f8d6062d7cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '92.36.125.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T20:05:03.000Z",
      "valid_until": "2026-05-27T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-25T19:58:27.478Z",
      "x_nadsec_last_seen": "2026-04-25T20:00:34.556Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12958"
      ],
      "x_nadsec_orgs": [
        "T2 Mobile LLC"
      ]
    },
    {
      "created": "2026-04-25T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=12; services=smbd; ports=445; cc=US; asn=396073; asn_org=Majestic Hosting Solutions, LLC",
      "id": "indicator--f16daec4-9c37-419f-91e0-ee859457a993",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '38.68.33.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T21:05:10.000Z",
      "valid_until": "2026-05-27T21:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-04-25T20:31:48.817Z",
      "x_nadsec_last_seen": "2026-04-25T20:32:45.489Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396073"
      ],
      "x_nadsec_orgs": [
        "Majestic Hosting Solutions, LLC"
      ]
    },
    {
      "created": "2026-04-25T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--17eed3d0-1299-4b62-912d-f0a04d35615d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '59.37.42.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T21:05:10.000Z",
      "valid_until": "2026-05-27T21:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-25T20:36:05.266Z",
      "x_nadsec_last_seen": "2026-04-25T20:38:16.974Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-25T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=UA; asn=211736; asn_org=FOP Dmytro Nedilskyi",
      "id": "indicator--c3f2107d-6c00-4839-a748-84b011bcc10a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.156.73.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T22:05:02.000Z",
      "valid_until": "2026-05-27T22:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-25T21:35:21.641Z",
      "x_nadsec_last_seen": "2026-04-25T21:35:21.641Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "211736"
      ],
      "x_nadsec_orgs": [
        "FOP Dmytro Nedilskyi"
      ]
    },
    {
      "created": "2026-04-25T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=SG; asn=152194; asn_org=CTG Server Limited",
      "id": "indicator--7f25bcd5-6895-48f1-8888-a057d450cf3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.32.228.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T23:05:02.000Z",
      "valid_until": "2026-05-27T23:05:00.000Z",
      "x_nadsec_event_count": 132,
      "x_nadsec_first_seen": "2026-04-25T22:56:06.600Z",
      "x_nadsec_last_seen": "2026-04-26T01:46:06.797Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "152194"
      ],
      "x_nadsec_orgs": [
        "CTG Server Limited"
      ]
    },
    {
      "created": "2026-04-25T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--be50ca16-c407-4642-a89f-9128f7ee4be1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T23:05:02.000Z",
      "valid_until": "2026-05-27T23:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-25T22:55:59.391Z",
      "x_nadsec_last_seen": "2026-04-25T22:55:59.391Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-25T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--68dd9a4d-702a-46dd-8b78-bf484a3b2d87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '27.70.202.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T23:05:02.000Z",
      "valid_until": "2026-05-27T23:05:00.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-25T23:04:53.103Z",
      "x_nadsec_last_seen": "2026-04-25T23:29:10.339Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-26T00:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=31; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--09e88e7a-225a-4b5b-a910-6b8db10c136c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T00:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '167.172.134.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T00:05:32.000Z",
      "valid_until": "2026-05-28T00:05:09.000Z",
      "x_nadsec_event_count": 31,
      "x_nadsec_first_seen": "2026-04-25T23:52:27.833Z",
      "x_nadsec_last_seen": "2026-04-25T23:55:16.928Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-26T00:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--505dbc16-e405-4c01-a7a4-43616222b880",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T00:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T00:05:32.000Z",
      "valid_until": "2026-05-28T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-25T23:08:19.826Z",
      "x_nadsec_last_seen": "2026-04-26T04:19:42.292Z",
      "x_nadsec_ports": [
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-26T00:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--cc215133-f976-412d-8b94-caf5d22e63a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T00:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '8.221.139.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T00:05:32.000Z",
      "valid_until": "2026-05-28T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-25T23:47:03.398Z",
      "x_nadsec_last_seen": "2026-04-25T23:47:03.398Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-26T00:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=25513; asn_org=PJSC Moscow city telephone network",
      "id": "indicator--d78ccf6e-d56c-4e73-a1e9-0a8f482cc231",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T00:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '95.165.84.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T00:05:32.000Z",
      "valid_until": "2026-05-28T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-25T23:42:54.281Z",
      "x_nadsec_last_seen": "2026-04-30T15:34:28.403Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25513"
      ],
      "x_nadsec_orgs": [
        "PJSC Moscow city telephone network"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-26T01:05:18.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=272925; asn_org=SAN JUAN INNOVA S.E.",
      "id": "indicator--4e28faa0-1a15-4581-9371-81fa7cd98d62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T01:05:18.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '201.254.231.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T01:05:18.000Z",
      "valid_until": "2026-05-28T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-26T00:28:09.447Z",
      "x_nadsec_last_seen": "2026-04-26T00:30:17.115Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "272925"
      ],
      "x_nadsec_orgs": [
        "SAN JUAN INNOVA S.E."
      ]
    },
    {
      "created": "2026-04-26T01:05:18.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CH; asn=402253; asn_org=SKN Subnet & Telecom Ltd",
      "id": "indicator--5a6cfc46-8b9e-4246-b2f0-dc9533f938c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T01:05:18.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '209.99.187.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T01:05:18.000Z",
      "valid_until": "2026-05-28T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T00:59:03.322Z",
      "x_nadsec_last_seen": "2026-04-26T00:59:03.322Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "402253"
      ],
      "x_nadsec_orgs": [
        "SKN Subnet & Telecom Ltd"
      ]
    },
    {
      "created": "2026-04-26T01:05:18.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--ef497090-6bf4-483f-af21-49ea590d95e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T01:05:18.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.101.155.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T01:05:18.000Z",
      "valid_until": "2026-05-28T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T00:39:35.229Z",
      "x_nadsec_last_seen": "2026-04-26T00:39:35.229Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-26T01:05:18.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=GB; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--ef1c2276-387b-4269-bed9-0d5a2048fe42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T01:05:18.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.227.43.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T01:05:18.000Z",
      "valid_until": "2026-05-28T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-26T00:59:10.331Z",
      "x_nadsec_last_seen": "2026-04-26T00:59:13.632Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-26T01:05:18.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--49b26535-ab32-4abc-85d0-563c7cf1f8e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T01:05:18.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T01:05:18.000Z",
      "valid_until": "2026-05-28T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T00:51:55.315Z",
      "x_nadsec_last_seen": "2026-04-26T00:51:55.315Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-26T01:05:18.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--d8148c42-b57e-434b-b432-934e8d080d61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T01:05:18.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T01:05:18.000Z",
      "valid_until": "2026-05-28T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T00:07:20.120Z",
      "x_nadsec_last_seen": "2026-04-26T00:07:20.120Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-26T01:05:18.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--dcb893e9-a005-4be4-8c11-b3b33465f216",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T01:05:18.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '98.81.162.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T01:05:18.000Z",
      "valid_until": "2026-05-28T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T00:55:55.104Z",
      "x_nadsec_last_seen": "2026-04-26T00:55:55.104Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-26T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--51c526c7-e939-4db7-945c-130ff98e4cef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.168.18.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T02:05:11.000Z",
      "valid_until": "2026-05-28T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-26T01:59:06.063Z",
      "x_nadsec_last_seen": "2026-04-26T02:01:11.025Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-26T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--970b84e3-1e23-4b3f-abb8-2c6b143569f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '8.216.9.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T02:05:11.000Z",
      "valid_until": "2026-05-28T02:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-26T01:26:27.749Z",
      "x_nadsec_last_seen": "2026-04-26T01:26:51.521Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-26T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=35598; asn_org=Inetcom Carrier LLC",
      "id": "indicator--880617b1-0922-4fd6-98d8-e1571ed27b05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.239.27.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T02:05:11.000Z",
      "valid_until": "2026-05-28T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-26T01:16:46.545Z",
      "x_nadsec_last_seen": "2026-04-26T01:25:41.918Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "35598"
      ],
      "x_nadsec_orgs": [
        "Inetcom Carrier LLC"
      ]
    },
    {
      "created": "2026-04-26T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--63bdce39-6f4e-44ab-9831-330ba6671330",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '121.35.41.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T03:05:10.000Z",
      "valid_until": "2026-05-28T03:05:09.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-04-26T02:38:20.113Z",
      "x_nadsec_last_seen": "2026-04-26T02:41:16.674Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-26T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4f8cdb1a-50a5-458a-9e61-1aead7b28224",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.174.211.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T03:05:10.000Z",
      "valid_until": "2026-05-28T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-26T02:15:44.356Z",
      "x_nadsec_last_seen": "2026-04-26T02:15:54.769Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-26T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=NL; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--4630284b-c687-4a09-8dad-635f120d308d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.62.228.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T03:05:10.000Z",
      "valid_until": "2026-05-28T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T02:56:50.469Z",
      "x_nadsec_last_seen": "2026-04-26T02:56:50.469Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-26T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CO; asn=273244; asn_org=EXPERTOS EN TECNOLOGIA Y TELECOMUNICACIONES S.A.S",
      "id": "indicator--9a4fe4cb-dc1d-41a5-aad2-ddc7623352ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '179.63.190.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T03:05:10.000Z",
      "valid_until": "2026-05-28T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-26T02:40:01.218Z",
      "x_nadsec_last_seen": "2026-04-26T02:40:01.308Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "273244"
      ],
      "x_nadsec_orgs": [
        "EXPERTOS EN TECNOLOGIA Y TELECOMUNICACIONES S.A.S"
      ]
    },
    {
      "created": "2026-04-26T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=691; services=smbd; ports=445; cc=PH; asn=9658; asn_org=Eastern Telecoms Phils., Inc.",
      "id": "indicator--7721a90e-065a-4b34-85d0-cfd630140170",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '180.232.172.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T03:05:10.000Z",
      "valid_until": "2026-05-28T03:05:09.000Z",
      "x_nadsec_event_count": 3148,
      "x_nadsec_first_seen": "2026-04-26T02:50:20.199Z",
      "x_nadsec_last_seen": "2026-04-26T03:45:47.889Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9658"
      ],
      "x_nadsec_orgs": [
        "Eastern Telecoms Phils., Inc."
      ]
    },
    {
      "created": "2026-04-26T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CL; asn=14117; asn_org=Telefonica del Sur S.A.",
      "id": "indicator--093b86d1-1be0-41eb-880e-498edff5d82b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.121.42.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T03:05:10.000Z",
      "valid_until": "2026-05-28T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-26T03:02:36.952Z",
      "x_nadsec_last_seen": "2026-04-26T03:04:43.526Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "14117"
      ],
      "x_nadsec_orgs": [
        "Telefonica del Sur S.A."
      ]
    },
    {
      "created": "2026-04-26T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--57e19779-6cdd-4f5b-b1a9-a2434f37ec0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.118.202.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T03:05:10.000Z",
      "valid_until": "2026-05-28T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T02:27:24.845Z",
      "x_nadsec_last_seen": "2026-04-26T02:27:24.845Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-26T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--20fc3304-699c-40e8-9daa-817ede97b8c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T03:05:10.000Z",
      "valid_until": "2026-05-28T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T02:30:45.555Z",
      "x_nadsec_last_seen": "2026-04-26T02:30:45.555Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-26T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GR; asn=6799; asn_org=OTEnet S.A.",
      "id": "indicator--079092c1-6776-44b1-a6c5-5137d9c85279",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '62.103.26.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T03:05:10.000Z",
      "valid_until": "2026-05-28T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-26T02:07:36.975Z",
      "x_nadsec_last_seen": "2026-04-26T02:09:43.752Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GR"
      ],
      "x_nadsec_asns": [
        "6799"
      ],
      "x_nadsec_orgs": [
        "OTEnet S.A."
      ]
    },
    {
      "created": "2026-04-26T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=NL; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--0173064e-d581-4d5f-93cc-2fe73f824aed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '89.190.156.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T03:05:10.000Z",
      "valid_until": "2026-05-28T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T02:22:47.321Z",
      "x_nadsec_last_seen": "2026-04-26T02:22:47.321Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-04-26T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--5f9774e5-1972-47a8-b8b9-9f605932c2b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '110.136.32.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T04:05:03.000Z",
      "valid_until": "2026-05-28T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-26T03:55:18.342Z",
      "x_nadsec_last_seen": "2026-04-26T03:57:23.048Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-26T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--9999bdb7-dd0c-4413-86b8-57baf41fa1a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T04:05:03.000Z",
      "valid_until": "2026-05-28T04:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-26T03:33:58.050Z",
      "x_nadsec_last_seen": "2026-04-26T03:33:58.851Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-26T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AR; asn=27747; asn_org=Telecentro S.A.",
      "id": "indicator--5221a78d-faca-49f8-889c-84bf32b8eda4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '181.45.253.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T04:05:03.000Z",
      "valid_until": "2026-05-28T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-26T03:12:13.943Z",
      "x_nadsec_last_seen": "2026-04-26T03:14:18.562Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27747"
      ],
      "x_nadsec_orgs": [
        "Telecentro S.A."
      ]
    },
    {
      "created": "2026-04-26T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.",
      "id": "indicator--b6b98985-0ebe-4889-ae2a-2de2f8eb7399",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.125.237.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T04:05:03.000Z",
      "valid_until": "2026-05-28T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T03:14:20.252Z",
      "x_nadsec_last_seen": "2026-04-26T03:14:20.252Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7303"
      ],
      "x_nadsec_orgs": [
        "Telecom Argentina S.A."
      ]
    },
    {
      "created": "2026-04-26T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--49707463-a2d9-47a9-9b58-dd881b9a0bd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.163.15.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T04:05:03.000Z",
      "valid_until": "2026-05-28T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T03:36:14.076Z",
      "x_nadsec_last_seen": "2026-04-26T03:36:14.076Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-26T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AR; asn=10834; asn_org=Telefonica de Argentina",
      "id": "indicator--a5ad1035-cfb5-45b2-ba8a-c02c70e75077",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '200.41.188.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T04:05:03.000Z",
      "valid_until": "2026-05-28T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T03:12:13.613Z",
      "x_nadsec_last_seen": "2026-04-26T03:12:13.613Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "10834"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-04-26T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=ZW; asn=14593; asn_org=Space Exploration Technologies Corporation; user(top)=**",
      "id": "indicator--1fa4c9cc-5582-4dc6-867d-6edbd86d893e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.105.37.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T06:05:05.000Z",
      "valid_until": "2026-05-28T06:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T05:32:36.850Z",
      "x_nadsec_last_seen": "2026-04-26T05:32:36.850Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "ZW"
      ],
      "x_nadsec_asns": [
        "14593"
      ],
      "x_nadsec_orgs": [
        "Space Exploration Technologies Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-26T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--56290187-9991-4118-bf2c-cd42ed92c57c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T06:05:05.000Z",
      "valid_until": "2026-05-28T06:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-26T05:39:34.678Z",
      "x_nadsec_last_seen": "2026-04-29T19:05:25.736Z",
      "x_nadsec_ports": [
        "445",
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-26T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--0e40264e-a4e2-4e74-8781-902a2ee8f52e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T06:05:05.000Z",
      "valid_until": "2026-05-28T06:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T05:51:05.570Z",
      "x_nadsec_last_seen": "2026-04-26T05:51:05.570Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-26T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--021602aa-f101-4954-a344-a23a8581d127",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T06:05:05.000Z",
      "valid_until": "2026-05-28T06:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T05:36:09.171Z",
      "x_nadsec_last_seen": "2026-04-26T05:36:09.171Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-26T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--801b6c19-b2d9-4e26-9cf3-0860f67d7a85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T06:05:05.000Z",
      "valid_until": "2026-05-28T06:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T05:36:19.496Z",
      "x_nadsec_last_seen": "2026-04-26T05:36:19.496Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-26T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--55f88a5a-9a9d-430f-8623-aea528a4dc4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.169.104.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T06:05:05.000Z",
      "valid_until": "2026-05-28T06:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-26T05:23:18.006Z",
      "x_nadsec_last_seen": "2026-04-26T05:23:28.150Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-26T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=CN; asn=146817; asn_org=Hubei Feixun Network Co., Ltd",
      "id": "indicator--99a85658-7a76-4ce2-92f7-b6cc115bcccd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '210.16.175.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T06:05:05.000Z",
      "valid_until": "2026-05-28T06:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-26T05:22:17.636Z",
      "x_nadsec_last_seen": "2026-04-29T15:01:02.110Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "146817"
      ],
      "x_nadsec_orgs": [
        "Hubei Feixun Network Co., Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "%****%"
      ]
    },
    {
      "created": "2026-04-26T07:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--81fb6f8f-4f92-4eff-b819-a6b6371aaa6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T07:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T07:05:19.000Z",
      "valid_until": "2026-05-28T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-26T06:33:08.992Z",
      "x_nadsec_last_seen": "2026-04-29T04:36:05.440Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-26T07:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--4d50633d-3af9-4da7-ae7f-0729b971a27f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T07:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T07:05:19.000Z",
      "valid_until": "2026-05-28T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-26T06:33:21.910Z",
      "x_nadsec_last_seen": "2026-04-29T04:36:13.735Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-26T07:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--c37df85d-19fb-442a-9b77-c7971cfc4d59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T07:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T07:05:19.000Z",
      "valid_until": "2026-05-28T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T06:33:23.676Z",
      "x_nadsec_last_seen": "2026-04-26T06:33:23.676Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-26T07:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--58787ca8-e734-4bf6-b533-5b2aaa06b62f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T07:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T07:05:19.000Z",
      "valid_until": "2026-05-28T07:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-26T06:33:27.608Z",
      "x_nadsec_last_seen": "2026-04-29T04:36:22.367Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-26T07:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--f8296f25-ca91-4003-8ed6-12b3f3b1444b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T07:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T07:05:19.000Z",
      "valid_until": "2026-05-28T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-26T06:33:31.065Z",
      "x_nadsec_last_seen": "2026-04-29T04:36:20.647Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-26T07:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--5fed55a9-36e0-437c-ad7a-30c1b64460b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T07:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T07:05:19.000Z",
      "valid_until": "2026-05-28T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-26T06:33:56.968Z",
      "x_nadsec_last_seen": "2026-04-29T04:35:36.936Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-26T07:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--2cd98388-4daf-4db9-9dc4-2c929dfacdd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T07:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T07:05:19.000Z",
      "valid_until": "2026-05-28T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T06:33:20.180Z",
      "x_nadsec_last_seen": "2026-04-26T06:33:20.180Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-26T07:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--b27bbbbd-7f54-44d8-98df-d22c84a3c0c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T07:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T07:05:19.000Z",
      "valid_until": "2026-05-28T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-26T06:33:39.723Z",
      "x_nadsec_last_seen": "2026-04-29T04:36:18.924Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-26T07:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--d941e9e7-defa-42df-bb22-3a88ca3de12d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T07:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T07:05:19.000Z",
      "valid_until": "2026-05-28T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-26T06:33:51.654Z",
      "x_nadsec_last_seen": "2026-04-29T04:35:54.821Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-26T07:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--19beff39-c32e-4ecb-86f1-ac51e3772916",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T07:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T07:05:19.000Z",
      "valid_until": "2026-05-28T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-26T06:34:00.445Z",
      "x_nadsec_last_seen": "2026-04-29T04:36:12.017Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-26T07:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--7bfa793b-6552-486d-bbe5-6c7bd57ada29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T07:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T07:05:19.000Z",
      "valid_until": "2026-05-28T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T06:33:29.336Z",
      "x_nadsec_last_seen": "2026-04-26T06:33:29.336Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-26T07:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--ec4191ae-39e9-4d05-90e0-a89045947d0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T07:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T07:05:19.000Z",
      "valid_until": "2026-05-28T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-26T06:33:25.404Z",
      "x_nadsec_last_seen": "2026-04-29T04:36:17.190Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-26T07:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--f6a151cd-b000-479d-b7d4-95ad20815b5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T07:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T07:05:19.000Z",
      "valid_until": "2026-05-28T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-26T06:33:05.472Z",
      "x_nadsec_last_seen": "2026-04-29T04:36:25.809Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-26T07:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--c2e4cc87-c196-4fe6-883f-663e5a2884f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T07:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T07:05:19.000Z",
      "valid_until": "2026-05-28T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-26T06:33:37.989Z",
      "x_nadsec_last_seen": "2026-04-26T06:34:02.963Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-26T07:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--ca1aec5d-e3ee-4b47-89a2-021d35d2e6fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T07:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T07:05:19.000Z",
      "valid_until": "2026-05-28T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-26T06:33:34.532Z",
      "x_nadsec_last_seen": "2026-04-29T04:36:00.133Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-26T07:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--7def5365-76ce-42a4-a268-b55c6f461078",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T07:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T07:05:19.000Z",
      "valid_until": "2026-05-28T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-26T06:33:36.261Z",
      "x_nadsec_last_seen": "2026-04-29T04:36:24.088Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-26T07:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--47034d4f-94de-4414-93f7-9f8de54c47f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T07:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T07:05:19.000Z",
      "valid_until": "2026-05-28T07:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-26T06:33:07.206Z",
      "x_nadsec_last_seen": "2026-04-29T04:35:58.405Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-26T07:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--18ba644f-a79f-429d-b9c5-ab4337551421",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T07:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T07:05:19.000Z",
      "valid_until": "2026-05-28T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-26T06:33:32.807Z",
      "x_nadsec_last_seen": "2026-04-29T04:36:09.401Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-26T07:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--c5faa1fb-8e4b-4c64-9180-a4bef32898ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T07:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T07:05:19.000Z",
      "valid_until": "2026-05-28T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-26T06:33:13.268Z",
      "x_nadsec_last_seen": "2026-04-26T06:33:58.703Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-26T07:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--745ce08a-7d4b-4836-b5a3-087a5c72ff0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T07:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T07:05:19.000Z",
      "valid_until": "2026-05-28T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-26T06:33:18.453Z",
      "x_nadsec_last_seen": "2026-04-29T04:35:53.068Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-26T07:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3102; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--969b130d-be16-4291-a5a0-52fbfc4de99d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T07:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.241.108.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T07:05:19.000Z",
      "valid_until": "2026-05-28T07:05:01.000Z",
      "x_nadsec_event_count": 3146,
      "x_nadsec_first_seen": "2026-04-26T04:37:06.131Z",
      "x_nadsec_last_seen": "2026-04-26T06:29:25.653Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-26T07:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=epmapper; ports=135; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--49fb972e-6544-401e-a93c-25a61e84bc5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T07:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T07:05:19.000Z",
      "valid_until": "2026-05-28T07:05:01.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-04-26T07:03:40.494Z",
      "x_nadsec_last_seen": "2026-04-26T18:31:12.977Z",
      "x_nadsec_ports": [
        "81",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-04-26T07:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--deb34e83-2f35-4f0c-95f5-3038614a7812",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T07:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T07:05:19.000Z",
      "valid_until": "2026-05-28T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T06:10:10.640Z",
      "x_nadsec_last_seen": "2026-04-26T06:10:10.640Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-26T07:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--62b59177-89cf-4234-9946-e8ee6be5b412",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T07:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T07:05:19.000Z",
      "valid_until": "2026-05-28T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T06:10:11.215Z",
      "x_nadsec_last_seen": "2026-04-26T06:10:11.215Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-26T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=264533; asn_org=ROBERTA CARDOSO JAHEL - ME",
      "id": "indicator--d9c24e6a-1608-46a6-bdbf-137147ca18c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '132.255.234.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T08:05:02.000Z",
      "valid_until": "2026-05-28T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-26T07:42:34.965Z",
      "x_nadsec_last_seen": "2026-04-26T07:44:42.287Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "264533"
      ],
      "x_nadsec_orgs": [
        "ROBERTA CARDOSO JAHEL - ME"
      ]
    },
    {
      "created": "2026-04-26T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--5f4f117d-11cc-4099-a95a-b745f4e6ec24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '137.184.83.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T08:05:02.000Z",
      "valid_until": "2026-05-28T08:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T07:28:11.459Z",
      "x_nadsec_last_seen": "2026-04-26T07:28:11.459Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-26T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NP; asn=4007; asn_org=Subisu Cablenet Pvt Ltd, Baluwatar, Kathmandu, Nepal",
      "id": "indicator--d2fa6610-b272-47eb-bf76-5cbade0616d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.93.89.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T08:05:02.000Z",
      "valid_until": "2026-05-28T08:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-26T07:23:52.929Z",
      "x_nadsec_last_seen": "2026-04-26T07:25:58.448Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NP"
      ],
      "x_nadsec_asns": [
        "4007"
      ],
      "x_nadsec_orgs": [
        "Subisu Cablenet Pvt Ltd, Baluwatar, Kathmandu, Nepal"
      ]
    },
    {
      "created": "2026-04-26T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--17a7898f-ad6f-4fad-bd0d-86c372e14c5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T08:05:02.000Z",
      "valid_until": "2026-05-28T08:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T08:00:03.125Z",
      "x_nadsec_last_seen": "2026-04-26T08:00:03.125Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-26T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--80c311fd-0bf6-4f14-8e46-d83c24c45f72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.249.128.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T08:05:02.000Z",
      "valid_until": "2026-05-28T08:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T07:15:05.601Z",
      "x_nadsec_last_seen": "2026-04-26T07:15:05.601Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-26T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--1d9296bb-381e-4d4f-956a-058abc514046",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.86.88.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T10:05:10.000Z",
      "valid_until": "2026-05-28T10:05:08.000Z",
      "x_nadsec_event_count": 29,
      "x_nadsec_first_seen": "2026-04-26T09:07:04.792Z",
      "x_nadsec_last_seen": "2026-04-30T23:32:49.831Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-04-26T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--51b1b754-7ccd-4cb2-89b1-a4e3a092d4a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.235.120.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T10:05:10.000Z",
      "valid_until": "2026-05-28T10:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-26T09:20:03.305Z",
      "x_nadsec_last_seen": "2026-04-26T09:20:04.120Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-26T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=TW; asn=3462; asn_org=Data Communication Business Group; user(top)=**",
      "id": "indicator--8db3e0f2-f368-422c-b058-2bebe26fdad4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.163.86.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T11:05:10.000Z",
      "valid_until": "2026-05-28T11:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-26T10:28:52.957Z",
      "x_nadsec_last_seen": "2026-04-26T10:28:53.330Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-26T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=RU; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--afb221bf-fa2f-485b-9173-cd5e85978e93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.176.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T11:05:10.000Z",
      "valid_until": "2026-05-28T11:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-26T10:17:50.530Z",
      "x_nadsec_last_seen": "2026-04-26T10:18:12.107Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-26T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=RU; asn=12418; asn_org=Quantum CJSC",
      "id": "indicator--78bec432-1f33-489a-b26f-288526aaf820",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '213.170.86.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T11:05:10.000Z",
      "valid_until": "2026-05-28T11:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T10:55:41.455Z",
      "x_nadsec_last_seen": "2026-04-26T10:55:41.455Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12418"
      ],
      "x_nadsec_orgs": [
        "Quantum CJSC"
      ]
    },
    {
      "created": "2026-04-26T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3111; services=smbd; ports=445; cc=IN; asn=45916; asn_org=Gujarat Telelink Pvt Ltd",
      "id": "indicator--6f63dde9-3661-4773-bac3-d8b3b2a1e107",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '43.249.232.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T11:05:10.000Z",
      "valid_until": "2026-05-28T11:05:08.000Z",
      "x_nadsec_event_count": 3155,
      "x_nadsec_first_seen": "2026-04-25T17:55:35.513Z",
      "x_nadsec_last_seen": "2026-04-26T10:39:54.933Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45916"
      ],
      "x_nadsec_orgs": [
        "Gujarat Telelink Pvt Ltd"
      ]
    },
    {
      "created": "2026-04-26T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation; user(top)=**",
      "id": "indicator--098aabd6-b86b-466b-aa7d-0e062b385411",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '52.150.16.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T11:05:10.000Z",
      "valid_until": "2026-05-28T11:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T10:21:04.130Z",
      "x_nadsec_last_seen": "2026-04-26T10:21:04.130Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-26T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--267bbacd-1def-4b4c-97c3-a5cce3fa4333",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T11:05:10.000Z",
      "valid_until": "2026-05-28T11:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T10:31:02.752Z",
      "x_nadsec_last_seen": "2026-04-26T10:31:02.752Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-26T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=KZ; asn=21299; asn_org=Kar-Tel LLC; user(top)=**",
      "id": "indicator--559a61eb-2617-49e9-81ba-d67e373a3e14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.29.137.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T11:05:10.000Z",
      "valid_until": "2026-05-28T11:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T10:25:09.028Z",
      "x_nadsec_last_seen": "2026-04-26T10:25:09.028Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "21299"
      ],
      "x_nadsec_orgs": [
        "Kar-Tel LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-26T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=328698; asn_org=ZA-GAS-CC",
      "id": "indicator--a297ec35-e98f-4b51-9b0d-31adc56e260f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.222.184.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T12:05:05.000Z",
      "valid_until": "2026-05-28T12:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-26T11:32:38.477Z",
      "x_nadsec_last_seen": "2026-04-26T11:34:46.685Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "328698"
      ],
      "x_nadsec_orgs": [
        "ZA-GAS-CC"
      ]
    },
    {
      "created": "2026-04-26T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC; user(top)=**",
      "id": "indicator--8ab30d94-cd77-4681-ac9b-96ac57b23a11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '2.88.101.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T12:05:05.000Z",
      "valid_until": "2026-05-28T12:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T11:57:20.411Z",
      "x_nadsec_last_seen": "2026-04-26T11:57:20.411Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-26T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--51779d1a-e19f-48d6-909c-0cea81d257f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.38.37.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T12:05:05.000Z",
      "valid_until": "2026-05-28T12:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-26T11:45:57.440Z",
      "x_nadsec_last_seen": "2026-04-28T22:45:56.436Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-04-26T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--e7f5b852-2707-478d-8ba6-610d3ea6549b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.78.160.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T12:05:05.000Z",
      "valid_until": "2026-05-28T12:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T11:45:58.088Z",
      "x_nadsec_last_seen": "2026-04-26T11:45:58.088Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-26T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--1ec24313-4a10-4f29-a79f-b8a658c2d5ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T12:05:05.000Z",
      "valid_until": "2026-05-28T12:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T12:03:42.624Z",
      "x_nadsec_last_seen": "2026-04-26T12:03:42.624Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-26T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--7a216106-3b1f-4617-ab31-a4d66c4d7f79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '78.187.211.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T12:05:05.000Z",
      "valid_until": "2026-05-28T12:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-26T11:37:14.379Z",
      "x_nadsec_last_seen": "2026-04-26T11:37:17.227Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-26T13:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BR; asn=266299; asn_org=MARCOS SINDOR RIBEIRAO BRANCO EIRELI - ME",
      "id": "indicator--d808930b-94eb-4954-9980-ee919d92ffbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T13:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '170.79.148.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T13:05:01.000Z",
      "valid_until": "2026-05-28T13:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-26T13:00:27.961Z",
      "x_nadsec_last_seen": "2026-04-26T13:07:28.472Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "266299"
      ],
      "x_nadsec_orgs": [
        "MARCOS SINDOR RIBEIRAO BRANCO EIRELI - ME"
      ]
    },
    {
      "created": "2026-04-26T13:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--cdaf3929-13d7-48bb-b1a6-4d5859a253ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T13:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.163.5.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T13:05:01.000Z",
      "valid_until": "2026-05-28T13:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T12:50:11.272Z",
      "x_nadsec_last_seen": "2026-04-26T12:50:11.272Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-26T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrord; ports=42; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--fa35c074-c080-43de-8a98-988ab5f7056b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T14:05:02.000Z",
      "valid_until": "2026-05-28T14:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-26T13:47:50.391Z",
      "x_nadsec_last_seen": "2026-04-26T13:47:50.406Z",
      "x_nadsec_ports": [
        "42",
        "33061"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-26T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--40c4ade5-82d6-4d5d-a467-4a9b9983200f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T14:05:02.000Z",
      "valid_until": "2026-05-28T14:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-26T13:52:49.169Z",
      "x_nadsec_last_seen": "2026-04-26T13:52:54.689Z",
      "x_nadsec_ports": [
        "81",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-26T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=IN; asn=135619; asn_org=Prakash Kumar Khetan TA WIRE AND WIRELESS SOLUTIONS",
      "id": "indicator--70440523-2104-4f67-8d6b-51e93a8af8d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '116.206.151.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T16:05:02.000Z",
      "valid_until": "2026-05-28T16:05:01.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-04-26T15:45:02.586Z",
      "x_nadsec_last_seen": "2026-04-26T15:47:19.127Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135619"
      ],
      "x_nadsec_orgs": [
        "Prakash Kumar Khetan TA WIRE AND WIRELESS SOLUTIONS"
      ]
    },
    {
      "created": "2026-04-26T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--cccbcd53-3e90-41c5-9523-0225d6dfbc3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T16:05:02.000Z",
      "valid_until": "2026-05-28T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T15:41:59.902Z",
      "x_nadsec_last_seen": "2026-04-26T15:41:59.902Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-26T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--54b61a7a-cadb-4362-adb4-9b6028055a29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '157.245.33.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T16:05:02.000Z",
      "valid_until": "2026-05-28T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T15:05:59.738Z",
      "x_nadsec_last_seen": "2026-04-26T15:05:59.738Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-26T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**",
      "id": "indicator--5c3a2e8d-167d-434d-8ee9-da9a61661980",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '175.7.241.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T16:05:02.000Z",
      "valid_until": "2026-05-28T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T15:46:35.586Z",
      "x_nadsec_last_seen": "2026-04-26T15:46:35.586Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-26T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--719a76f2-d512-4bfb-b095-cca9e883e58d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.74.4.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T16:05:02.000Z",
      "valid_until": "2026-05-28T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-26T15:59:33.057Z",
      "x_nadsec_last_seen": "2026-04-26T16:01:38.025Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-04-26T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=15924; asn_org=Vodafone Net Iletisim Hizmetler AS",
      "id": "indicator--78903ba4-2744-4c25-96ca-a7596e90db7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.87.235.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T16:05:02.000Z",
      "valid_until": "2026-05-28T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-26T15:05:04.836Z",
      "x_nadsec_last_seen": "2026-04-26T15:07:12.262Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "15924"
      ],
      "x_nadsec_orgs": [
        "Vodafone Net Iletisim Hizmetler AS"
      ]
    },
    {
      "created": "2026-04-26T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=46; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--022dc078-13da-4421-8426-7c3f077a547c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.48.50.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T16:05:02.000Z",
      "valid_until": "2026-05-28T16:05:01.000Z",
      "x_nadsec_event_count": 46,
      "x_nadsec_first_seen": "2026-04-26T15:07:22.287Z",
      "x_nadsec_last_seen": "2026-04-26T15:09:37.698Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-26T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=EG; asn=8452; asn_org=TE Data; user(top)=**",
      "id": "indicator--5136ec5a-c877-474d-a9f8-407f3293080b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.232.167.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T16:05:02.000Z",
      "valid_until": "2026-05-28T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T15:18:03.683Z",
      "x_nadsec_last_seen": "2026-04-26T15:18:03.683Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-26T17:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--27c079d8-7a2a-4cb4-bba3-d161212e14eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T17:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '106.117.116.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T17:05:07.000Z",
      "valid_until": "2026-05-28T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T16:14:35.654Z",
      "x_nadsec_last_seen": "2026-04-26T16:14:35.654Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-26T17:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--d60368d6-43a3-4a8f-9365-3bfd9283e61b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T17:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.182.130.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T17:05:07.000Z",
      "valid_until": "2026-05-28T17:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-26T16:40:28.705Z",
      "x_nadsec_last_seen": "2026-04-26T16:44:43.798Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "445",
        "1723",
        "1883",
        "27017",
        "35181"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-26T17:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6e72f6b9-ff8b-440b-89ae-8059b7caf90e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T17:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T17:05:07.000Z",
      "valid_until": "2026-05-28T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T16:06:33.268Z",
      "x_nadsec_last_seen": "2026-04-26T16:06:33.268Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-26T17:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=DO; asn=28118; asn_org=ALTICE DOMINICANA S.A.",
      "id": "indicator--064f3976-116f-45d8-b6a5-da0916e88a8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T17:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.149.199.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T17:05:07.000Z",
      "valid_until": "2026-05-28T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T16:31:26.219Z",
      "x_nadsec_last_seen": "2026-04-26T16:31:26.219Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DO"
      ],
      "x_nadsec_asns": [
        "28118"
      ],
      "x_nadsec_orgs": [
        "ALTICE DOMINICANA S.A."
      ]
    },
    {
      "created": "2026-04-26T17:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e6cc0f3e-d5d7-42ca-9056-be8488ae800b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T17:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T17:05:07.000Z",
      "valid_until": "2026-05-28T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T16:32:37.771Z",
      "x_nadsec_last_seen": "2026-04-26T16:32:37.771Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-26T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=36352; asn_org=HostPapa",
      "id": "indicator--18e41dc5-c3ba-4d4e-8734-eeabe98087b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '107.174.52.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T18:05:02.000Z",
      "valid_until": "2026-05-28T18:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-26T17:24:18.068Z",
      "x_nadsec_last_seen": "2026-04-26T17:24:18.074Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "36352"
      ],
      "x_nadsec_orgs": [
        "HostPapa"
      ]
    },
    {
      "created": "2026-04-26T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--cda7f70a-ba8e-4a92-8bed-466456505736",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '134.33.73.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T18:05:02.000Z",
      "valid_until": "2026-05-28T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T17:10:04.774Z",
      "x_nadsec_last_seen": "2026-04-26T17:10:04.774Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-26T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--87f963eb-3c34-44d7-90c7-c6fd1733a9f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.102.117.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T18:05:02.000Z",
      "valid_until": "2026-05-28T18:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-26T17:23:55.232Z",
      "x_nadsec_last_seen": "2026-04-26T17:23:55.690Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-26T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=70; services=mysqld; ports=3306; cc=CN; asn=24445; asn_org=Henan Mobile Communications Co.,Ltd; user(top)=r**t",
      "id": "indicator--177c49c6-2395-457b-92ec-28be552925fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '39.165.245.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T18:05:02.000Z",
      "valid_until": "2026-05-28T18:05:01.000Z",
      "x_nadsec_event_count": 420,
      "x_nadsec_first_seen": "2026-04-26T17:32:19.944Z",
      "x_nadsec_last_seen": "2026-04-28T06:30:39.049Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "24445"
      ],
      "x_nadsec_orgs": [
        "Henan Mobile Communications Co.,Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-26T19:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--47b28d6a-752e-4312-b54a-249f661e3dd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T19:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.143.142.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T19:05:02.000Z",
      "valid_until": "2026-05-28T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-26T18:39:41.740Z",
      "x_nadsec_last_seen": "2026-04-26T18:41:47.204Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-04-26T19:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--fbf40437-fc36-4023-b823-807f6e3dce7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T19:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T19:05:02.000Z",
      "valid_until": "2026-05-28T19:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T18:36:52.731Z",
      "x_nadsec_last_seen": "2026-04-26T18:36:52.731Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-26T19:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3b9a892f-3739-407b-8912-f0b9aa9508cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T19:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T19:05:02.000Z",
      "valid_until": "2026-05-28T19:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T18:36:42.477Z",
      "x_nadsec_last_seen": "2026-04-26T18:36:42.477Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-26T19:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--43deacf6-671e-4ccf-bcdd-8ecdb2d6532b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T19:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T19:05:02.000Z",
      "valid_until": "2026-05-28T19:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T18:11:37.751Z",
      "x_nadsec_last_seen": "2026-04-26T18:11:37.751Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-26T19:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IT; asn=12874; asn_org=Fastweb",
      "id": "indicator--19c97261-5a5c-4b55-9e1b-767205a52992",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T19:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '93.47.40.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T19:05:02.000Z",
      "valid_until": "2026-05-28T19:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T18:37:52.815Z",
      "x_nadsec_last_seen": "2026-04-26T18:37:52.815Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "12874"
      ],
      "x_nadsec_orgs": [
        "Fastweb"
      ]
    },
    {
      "created": "2026-04-26T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--42f7d581-8370-4469-8fa8-062e88fa9ccc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '101.36.118.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T20:05:02.000Z",
      "valid_until": "2026-05-28T20:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-26T19:39:51.225Z",
      "x_nadsec_last_seen": "2026-04-26T19:40:13.461Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-26T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a38be5bb-d9aa-4571-a060-cb5940372cc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T20:05:02.000Z",
      "valid_until": "2026-05-28T20:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-21T20:05:07.484Z",
      "x_nadsec_last_seen": "2026-04-26T19:27:20.343Z",
      "x_nadsec_ports": [
        "21",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-26T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=PH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--00e1863b-b931-4cec-960f-185add6e072e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.58.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T20:05:02.000Z",
      "valid_until": "2026-05-28T20:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-26T20:03:39.256Z",
      "x_nadsec_last_seen": "2026-04-26T20:04:08.365Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-26T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=21497; asn_org=PrJSC VF UKRAINE",
      "id": "indicator--dca69e2c-7925-4678-862e-39d6eac0db0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '77.52.66.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T20:05:02.000Z",
      "valid_until": "2026-05-28T20:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-26T19:16:17.703Z",
      "x_nadsec_last_seen": "2026-04-26T19:18:24.435Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "21497"
      ],
      "x_nadsec_orgs": [
        "PrJSC VF UKRAINE"
      ]
    },
    {
      "created": "2026-04-26T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=GB; asn=201002; asn_org=PebbleHost Ltd",
      "id": "indicator--137b29b5-e297-43ce-a988-6dca1b0e2c7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T20:05:02.000Z",
      "valid_until": "2026-05-28T20:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-26T19:15:16.399Z",
      "x_nadsec_last_seen": "2026-04-27T13:25:22.497Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "201002"
      ],
      "x_nadsec_orgs": [
        "PebbleHost Ltd"
      ]
    },
    {
      "created": "2026-04-26T21:05:27.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=GB; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--8f7f7905-6f08-4a38-be8d-2a7daa703557",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T21:05:27.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.174.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T21:05:27.000Z",
      "valid_until": "2026-05-28T21:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-26T20:50:39.659Z",
      "x_nadsec_last_seen": "2026-04-26T20:50:59.449Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-26T21:05:27.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=ZA; asn=329184; asn_org=Host-Africa-AS2; user(top)=**",
      "id": "indicator--5c230c55-d0ad-4515-8882-9e01aec5f50b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T21:05:27.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '169.239.181.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T21:05:27.000Z",
      "valid_until": "2026-05-28T21:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T21:02:59.882Z",
      "x_nadsec_last_seen": "2026-04-26T21:02:59.882Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "329184"
      ],
      "x_nadsec_orgs": [
        "Host-Africa-AS2"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-26T21:05:27.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--1b60a3ae-2989-4199-8832-934c0d72a6aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T21:05:27.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.129.74.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T21:05:27.000Z",
      "valid_until": "2026-05-28T21:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-26T20:51:16.637Z",
      "x_nadsec_last_seen": "2026-04-26T20:53:22.739Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-04-26T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--60939dbd-d587-4e3d-83ef-b235039c2c90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.46.246.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T22:05:02.000Z",
      "valid_until": "2026-05-28T22:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-26T22:00:19.349Z",
      "x_nadsec_last_seen": "2026-04-26T22:00:29.522Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-26T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--24589c4f-2325-40e6-9607-0f5da56ddbc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '8.216.9.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T22:05:02.000Z",
      "valid_until": "2026-05-28T22:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-26T21:36:27.143Z",
      "x_nadsec_last_seen": "2026-04-26T21:36:50.922Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-26T23:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=9009; asn_org=M247 Europe SRL; user(top)=c**n",
      "id": "indicator--88d26581-9581-4320-85ab-9e83fe15aead",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T23:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.174.5.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T23:05:11.000Z",
      "valid_until": "2026-05-28T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-26T22:46:22.229Z",
      "x_nadsec_last_seen": "2026-04-26T22:46:22.229Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "9009"
      ],
      "x_nadsec_orgs": [
        "M247 Europe SRL"
      ],
      "x_nadsec_usernames_attempted": [
        "c**n"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-26T23:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--caf83ef9-9133-4b2e-a0fb-ea8387f35a3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T23:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.64.106.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T23:05:11.000Z",
      "valid_until": "2026-05-28T23:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-26T22:40:57.748Z",
      "x_nadsec_last_seen": "2026-04-26T22:41:07.908Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-27T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=61; services=mysqld; ports=3306; cc=KR; asn=3786; asn_org=LG DACOM Corporation; user(top)=d****r",
      "id": "indicator--67a2adfe-1951-4b4c-b9bb-21da353a9410",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '106.248.224.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T00:05:03.000Z",
      "valid_until": "2026-05-29T00:05:01.000Z",
      "x_nadsec_event_count": 61,
      "x_nadsec_first_seen": "2026-04-26T23:09:58.530Z",
      "x_nadsec_last_seen": "2026-04-26T23:14:53.718Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "3786"
      ],
      "x_nadsec_orgs": [
        "LG DACOM Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "d****r"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-27T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--cb52e5ee-fdaa-4785-8ea4-0d0c12cdec07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T00:05:03.000Z",
      "valid_until": "2026-05-29T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-27T00:02:24.554Z",
      "x_nadsec_last_seen": "2026-04-30T20:12:08.085Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-27T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--8c1d030d-1074-495d-a9ed-e57d52068278",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T00:05:03.000Z",
      "valid_until": "2026-05-29T00:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-26T23:08:35.117Z",
      "x_nadsec_last_seen": "2026-04-26T23:08:35.906Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-27T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--ed03f624-724d-413d-a0da-46ac085144bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T00:05:03.000Z",
      "valid_until": "2026-05-29T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-26T23:17:37.153Z",
      "x_nadsec_last_seen": "2026-04-26T23:17:37.535Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-27T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--bbce3b02-8dc2-4823-9665-05daa7cafbc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T02:05:03.000Z",
      "valid_until": "2026-05-29T02:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T02:01:53.298Z",
      "x_nadsec_last_seen": "2026-04-27T02:01:53.298Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-27T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--61b398c8-d3cf-46b9-ac0c-b28d41cce9a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.232.121.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T02:05:03.000Z",
      "valid_until": "2026-05-29T02:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-27T01:17:02.767Z",
      "x_nadsec_last_seen": "2026-04-27T01:19:07.845Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-27T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=EG; asn=8452; asn_org=TE Data; user(top)=**",
      "id": "indicator--bf43d74a-b9e1-4a68-8fcf-177da7fc512a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '81.10.24.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T02:05:03.000Z",
      "valid_until": "2026-05-29T02:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-27T01:49:46.401Z",
      "x_nadsec_last_seen": "2026-04-27T01:49:47.727Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-27T03:05:27.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=GB; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--c72b69f4-f2cc-4f65-98d2-d25e6b6f2e5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T03:05:27.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '101.36.97.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T03:05:27.000Z",
      "valid_until": "2026-05-29T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-27T02:53:03.901Z",
      "x_nadsec_last_seen": "2026-04-27T02:53:23.696Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-27T03:05:27.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--f568f17a-25ce-4026-9014-413cbfdc8543",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T03:05:27.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '125.163.114.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T03:05:27.000Z",
      "valid_until": "2026-05-29T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-27T02:30:27.996Z",
      "x_nadsec_last_seen": "2026-04-27T02:32:36.512Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-27T03:05:27.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.; user(top)=a*******s; pass(top)=a********@",
      "id": "indicator--73949a6b-da68-4860-8253-7230beccc160",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T03:05:27.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.97.5.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T03:05:27.000Z",
      "valid_until": "2026-05-29T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T02:55:11.475Z",
      "x_nadsec_last_seen": "2026-04-27T02:55:11.475Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-04-27T03:05:27.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ES; asn=56882; asn_org=Aire Networks Del Mediterraneo Sl Unipersonal",
      "id": "indicator--f06f068c-aa66-465c-b1d5-98251e0cc42b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T03:05:27.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.130.153.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T03:05:27.000Z",
      "valid_until": "2026-05-29T03:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-27T02:59:24.242Z",
      "x_nadsec_last_seen": "2026-04-27T02:59:24.450Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "56882"
      ],
      "x_nadsec_orgs": [
        "Aire Networks Del Mediterraneo Sl Unipersonal"
      ]
    },
    {
      "created": "2026-04-27T04:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--e282d31c-7472-4d1b-aaae-198add06001d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T04:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.182.194.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T04:05:22.000Z",
      "valid_until": "2026-05-29T04:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-27T04:00:15.662Z",
      "x_nadsec_last_seen": "2026-04-27T04:02:19.951Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-04-27T04:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=ID; asn=21859; asn_org=Zenlayer Inc; user(top)=r**t",
      "id": "indicator--cc4da3bb-0da9-4de2-9289-0956044ac707",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T04:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '129.227.46.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T04:05:22.000Z",
      "valid_until": "2026-05-29T04:05:06.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T03:56:34.662Z",
      "x_nadsec_last_seen": "2026-04-27T03:56:34.662Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-27T04:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=3216; asn_org=PVimpelCom",
      "id": "indicator--9e6c9324-d9e7-4ce3-8aac-74bb2044cdbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T04:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.218.224.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T04:05:22.000Z",
      "valid_until": "2026-05-29T04:05:06.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-27T03:48:56.001Z",
      "x_nadsec_last_seen": "2026-04-27T03:58:51.846Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "3216"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-04-27T04:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=271402; asn_org=Live Conect Telecomunicacoes Ltda.",
      "id": "indicator--89241ed8-cccd-4ffb-a808-a25fb7767283",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T04:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '200.39.40.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T04:05:22.000Z",
      "valid_until": "2026-05-29T04:05:06.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-27T03:32:05.249Z",
      "x_nadsec_last_seen": "2026-04-27T03:32:07.382Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "271402"
      ],
      "x_nadsec_orgs": [
        "Live Conect Telecomunicacoes Ltda."
      ]
    },
    {
      "created": "2026-04-27T04:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--560064df-2cfb-40e2-8af8-bc86df615393",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T04:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.140.251.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T04:05:22.000Z",
      "valid_until": "2026-05-29T04:05:06.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T03:36:39.761Z",
      "x_nadsec_last_seen": "2026-04-27T03:36:39.761Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-27T04:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--aca228a1-280e-489c-be83-0c7c3457b9a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T04:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T04:05:22.000Z",
      "valid_until": "2026-05-29T04:05:06.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T03:39:34.354Z",
      "x_nadsec_last_seen": "2026-04-27T03:39:34.354Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-27T04:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=epmapper; ports=135; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--758c7b7f-1301-4198-8c52-cd8bbec7ff86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T04:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.91.93.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T04:05:22.000Z",
      "valid_until": "2026-05-29T04:05:06.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-27T03:05:24.641Z",
      "x_nadsec_last_seen": "2026-04-27T03:06:08.148Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-27T04:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--85d1793a-8ccf-48c5-8fd6-ec87668cb5c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T04:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '61.220.55.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T04:05:22.000Z",
      "valid_until": "2026-05-29T04:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-27T03:06:59.754Z",
      "x_nadsec_last_seen": "2026-04-27T03:09:05.771Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-27T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--861762b0-bfd7-499c-a0fc-f7762621dfc2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T05:05:03.000Z",
      "valid_until": "2026-05-29T05:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-27T04:54:53.118Z",
      "x_nadsec_last_seen": "2026-04-27T04:55:03.506Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-27T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=LK; asn=9329; asn_org=Sri Lanka Telecom Internet; user(top)=**",
      "id": "indicator--bba057d7-7105-4809-8029-54984297b479",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '220.247.247.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T05:05:03.000Z",
      "valid_until": "2026-05-29T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T04:31:55.858Z",
      "x_nadsec_last_seen": "2026-04-27T04:31:55.858Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "9329"
      ],
      "x_nadsec_orgs": [
        "Sri Lanka Telecom Internet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-27T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--39e668b8-2270-4b4e-a0b4-726d73ac27e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.124.81.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T05:05:03.000Z",
      "valid_until": "2026-05-29T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T04:24:39.917Z",
      "x_nadsec_last_seen": "2026-04-27T04:24:39.917Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-27T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--ee69a1de-760c-45f3-bdf2-6b43ffdceb66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T05:05:03.000Z",
      "valid_until": "2026-05-29T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T04:15:50.772Z",
      "x_nadsec_last_seen": "2026-04-27T04:15:50.772Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-27T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=47; services=smbd; ports=445; cc=SY; asn=29256; asn_org=Syrian Telecommunication Private Closed Joint Stock Company",
      "id": "indicator--58478b75-3041-488b-b65f-ff53a03f0c1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '82.137.255.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T05:05:03.000Z",
      "valid_until": "2026-05-29T05:05:01.000Z",
      "x_nadsec_event_count": 47,
      "x_nadsec_first_seen": "2026-04-27T04:50:08.547Z",
      "x_nadsec_last_seen": "2026-04-27T04:54:06.294Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SY"
      ],
      "x_nadsec_asns": [
        "29256"
      ],
      "x_nadsec_orgs": [
        "Syrian Telecommunication Private Closed Joint Stock Company"
      ]
    },
    {
      "created": "2026-04-27T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=GB; asn=201002; asn_org=PebbleHost Ltd",
      "id": "indicator--39bb51e8-9c01-49cb-a2bf-52c608a6f5f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T05:05:03.000Z",
      "valid_until": "2026-05-29T05:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-27T04:35:30.996Z",
      "x_nadsec_last_seen": "2026-04-27T18:11:06.259Z",
      "x_nadsec_ports": [
        "81",
        "1433",
        "1723"
      ],
      "x_nadsec_services": [
        "httpd",
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "201002"
      ],
      "x_nadsec_orgs": [
        "PebbleHost Ltd"
      ]
    },
    {
      "created": "2026-04-27T06:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--6c7c2491-c16a-48cd-8a75-bd824cba6a66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T06:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '111.50.66.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T06:05:04.000Z",
      "valid_until": "2026-05-29T06:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-27T05:47:41.294Z",
      "x_nadsec_last_seen": "2026-04-27T05:47:48.288Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-04-27T06:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=24086; asn_org=Viettel Corporation",
      "id": "indicator--a0620c66-8c63-43d8-bb04-0638c85d7ce6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T06:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '116.100.7.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T06:05:04.000Z",
      "valid_until": "2026-05-29T06:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-27T05:27:21.494Z",
      "x_nadsec_last_seen": "2026-04-27T05:33:53.625Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "24086"
      ],
      "x_nadsec_orgs": [
        "Viettel Corporation"
      ]
    },
    {
      "created": "2026-04-27T06:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--29c865ec-dee9-4f50-a77a-efbc247ee7a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T06:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.182.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T06:05:04.000Z",
      "valid_until": "2026-05-29T06:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-27T06:01:37.397Z",
      "x_nadsec_last_seen": "2026-04-27T06:01:48.705Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a*******s"
      ]
    },
    {
      "created": "2026-04-27T06:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MX; asn=8151; asn_org=UNINET; user(top)=**",
      "id": "indicator--dbd90453-8c6c-4415-b3b5-ee13e0b71a10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T06:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.248.133.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T06:05:04.000Z",
      "valid_until": "2026-05-29T06:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T05:52:52.685Z",
      "x_nadsec_last_seen": "2026-04-27T05:52:52.685Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-27T06:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--1e1e3e53-397e-4c3c-b87d-144164390e93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T06:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.163.34.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T06:05:04.000Z",
      "valid_until": "2026-05-29T06:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T05:40:37.365Z",
      "x_nadsec_last_seen": "2026-04-27T05:40:37.365Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-27T06:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b899efe0-0ce6-4280-806f-3648cee4ef1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T06:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T06:05:04.000Z",
      "valid_until": "2026-05-29T06:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T05:31:06.725Z",
      "x_nadsec_last_seen": "2026-04-27T05:31:06.725Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-27T06:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RS; asn=9125; asn_org=Drustvo za telekomunikacije Orion telekom doo Beograd-Zemun",
      "id": "indicator--84d28b5a-f1f2-4f20-8b9b-ccccbc051048",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T06:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '77.105.2.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T06:05:04.000Z",
      "valid_until": "2026-05-29T06:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-27T05:14:53.889Z",
      "x_nadsec_last_seen": "2026-04-27T05:17:00.556Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RS"
      ],
      "x_nadsec_asns": [
        "9125"
      ],
      "x_nadsec_orgs": [
        "Drustvo za telekomunikacije Orion telekom doo Beograd-Zemun"
      ]
    },
    {
      "created": "2026-04-27T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c5a6673d-976a-43dc-b00f-597b05c03595",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.106.17.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T07:05:03.000Z",
      "valid_until": "2026-05-29T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T06:59:15.644Z",
      "x_nadsec_last_seen": "2026-04-27T06:59:15.644Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-27T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--a80346ea-b033-44c1-bbda-5437f66b04b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T07:05:03.000Z",
      "valid_until": "2026-05-29T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T06:44:45.771Z",
      "x_nadsec_last_seen": "2026-04-27T06:44:45.771Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-27T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=AU; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--09ef3c5f-7b47-49eb-b5a2-b6d0dac5c770",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '134.199.145.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T08:05:03.000Z",
      "valid_until": "2026-05-29T08:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-27T08:03:05.789Z",
      "x_nadsec_last_seen": "2026-04-27T08:03:42.517Z",
      "x_nadsec_ports": [
        "445",
        "27017",
        "1433",
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "mongod",
        "smbd",
        "mssqld",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-27T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=32; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b5a50ab4-3932-425a-a288-e824714b3181",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '159.223.169.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T08:05:03.000Z",
      "valid_until": "2026-05-29T08:05:01.000Z",
      "x_nadsec_event_count": 32,
      "x_nadsec_first_seen": "2026-04-27T07:30:07.423Z",
      "x_nadsec_last_seen": "2026-04-27T07:32:56.964Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-27T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f90763d5-18d4-417d-8a4a-1325ac9f4d3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T08:05:03.000Z",
      "valid_until": "2026-05-29T08:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-27T07:37:17.781Z",
      "x_nadsec_last_seen": "2026-04-27T07:37:28.132Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-27T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=46; services=smbd; ports=445; cc=UA; asn=202845; asn_org=LLC Unetco Corp",
      "id": "indicator--2d86e662-b5a1-4f46-b618-84545452363b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '212.8.60.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T08:05:03.000Z",
      "valid_until": "2026-05-29T08:05:01.000Z",
      "x_nadsec_event_count": 46,
      "x_nadsec_first_seen": "2026-04-27T07:17:24.965Z",
      "x_nadsec_last_seen": "2026-04-27T07:20:31.921Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "202845"
      ],
      "x_nadsec_orgs": [
        "LLC Unetco Corp"
      ]
    },
    {
      "created": "2026-04-27T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--f67a6179-f3d8-4e46-a02d-162bf96eafa2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '223.206.64.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T08:05:03.000Z",
      "valid_until": "2026-05-29T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-27T07:21:52.485Z",
      "x_nadsec_last_seen": "2026-04-27T07:23:57.019Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-04-27T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--9a065f90-402c-4832-94e2-9d5cb0a83443",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '24.144.112.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T08:05:03.000Z",
      "valid_until": "2026-05-29T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-27T07:33:00.166Z",
      "x_nadsec_last_seen": "2026-04-28T07:54:53.811Z",
      "x_nadsec_ports": [
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-27T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ea64cae8-cf8c-45bd-b362-b5f093e50d2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.233.112.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T09:05:04.000Z",
      "valid_until": "2026-05-29T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-27T08:24:23.698Z",
      "x_nadsec_last_seen": "2026-04-27T08:24:33.875Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-27T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c6867d9b-c98f-4dac-91ea-dee4f7bac88c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.106.197.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T09:05:04.000Z",
      "valid_until": "2026-05-29T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-27T08:51:13.356Z",
      "x_nadsec_last_seen": "2026-04-27T08:51:14.317Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-27T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--dc44a5b4-3ddd-4dab-843d-53156284740d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.106.207.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T09:05:04.000Z",
      "valid_until": "2026-05-29T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-27T08:43:06.599Z",
      "x_nadsec_last_seen": "2026-04-27T08:43:06.613Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-27T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--706406d4-071e-459d-8077-6270482ec655",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.62.91.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T09:05:04.000Z",
      "valid_until": "2026-05-29T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T08:28:45.117Z",
      "x_nadsec_last_seen": "2026-04-27T08:28:45.117Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-27T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--76a7e0b9-5311-4405-acac-39f7156f187c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.205.126.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T09:05:04.000Z",
      "valid_until": "2026-05-29T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-27T08:28:47.327Z",
      "x_nadsec_last_seen": "2026-04-27T08:29:22.375Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-04-27T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--4bc1b8f5-b298-4f34-8b08-1b055ae2f208",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T09:05:04.000Z",
      "valid_until": "2026-05-29T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T08:43:40.199Z",
      "x_nadsec_last_seen": "2026-04-27T08:43:40.199Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-27T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--1ed32274-b27e-4982-81ee-6b29a312c911",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T09:05:04.000Z",
      "valid_until": "2026-05-29T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T08:31:14.046Z",
      "x_nadsec_last_seen": "2026-04-27T08:31:14.046Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-27T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=701; asn_org=Verizon Business",
      "id": "indicator--a6f243b8-5fa6-42da-a925-745accf29338",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '96.241.201.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T09:05:04.000Z",
      "valid_until": "2026-05-29T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-23T19:08:48.824Z",
      "x_nadsec_last_seen": "2026-04-27T08:35:45.921Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "701"
      ],
      "x_nadsec_orgs": [
        "Verizon Business"
      ]
    },
    {
      "created": "2026-04-27T11:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=32; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--ecf74664-f835-4b5d-ab9d-2550d6257a2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T11:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.199.90.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T11:05:04.000Z",
      "valid_until": "2026-05-29T11:05:03.000Z",
      "x_nadsec_event_count": 32,
      "x_nadsec_first_seen": "2026-04-27T10:26:16.572Z",
      "x_nadsec_last_seen": "2026-04-27T10:28:24.564Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-27T11:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AR; asn=52402; asn_org=INTERCITY COMUNICACIONES S.A.",
      "id": "indicator--4704acfc-9529-4ec9-b7cd-c5913f2ce3e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T11:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '200.123.248.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T11:05:04.000Z",
      "valid_until": "2026-05-29T11:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-27T10:36:29.888Z",
      "x_nadsec_last_seen": "2026-04-27T10:36:29.982Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "52402"
      ],
      "x_nadsec_orgs": [
        "INTERCITY COMUNICACIONES S.A."
      ]
    },
    {
      "created": "2026-04-27T11:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--57c8e6e7-2608-4f96-84a1-33d259cc92fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T11:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.84.141.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T11:05:04.000Z",
      "valid_until": "2026-05-29T11:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T10:06:20.438Z",
      "x_nadsec_last_seen": "2026-04-27T10:06:20.438Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-27T12:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BD; asn=23956; asn_org=AmberIT Limited",
      "id": "indicator--5808f3a6-fa78-4094-9397-5fd999411fe2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T12:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.179.167.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T12:05:06.000Z",
      "valid_until": "2026-05-29T12:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-12T00:51:42.036Z",
      "x_nadsec_last_seen": "2026-04-27T11:06:36.081Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "23956"
      ],
      "x_nadsec_orgs": [
        "AmberIT Limited"
      ]
    },
    {
      "created": "2026-04-27T12:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=28343; asn_org=UNIFIQUE TELECOMUNICACOES SA",
      "id": "indicator--5c5038a1-378c-4c83-888c-1f4bd24da1d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T12:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.237.144.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T12:05:06.000Z",
      "valid_until": "2026-05-29T12:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-27T11:50:08.969Z",
      "x_nadsec_last_seen": "2026-04-27T11:57:11.765Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28343"
      ],
      "x_nadsec_orgs": [
        "UNIFIQUE TELECOMUNICACOES SA"
      ]
    },
    {
      "created": "2026-04-27T12:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=29; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--f9f90496-ae5b-497c-a1f5-08e7e5be0257",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T12:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.62.98.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T12:05:06.000Z",
      "valid_until": "2026-05-29T12:05:04.000Z",
      "x_nadsec_event_count": 29,
      "x_nadsec_first_seen": "2026-04-27T11:09:15.433Z",
      "x_nadsec_last_seen": "2026-04-27T11:09:28.317Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "***",
        "",
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-27T12:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--04cc9364-1f41-4bc6-8b7f-7a91bf87533f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T12:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.205.231.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T12:05:06.000Z",
      "valid_until": "2026-05-29T12:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T11:09:13.747Z",
      "x_nadsec_last_seen": "2026-04-27T11:09:13.747Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-27T12:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--93ed98b9-912b-4ac0-b080-ef07f582025b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T12:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.119.43.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T12:05:06.000Z",
      "valid_until": "2026-05-29T12:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-27T11:52:50.552Z",
      "x_nadsec_last_seen": "2026-04-27T11:52:51.193Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-27T12:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--97c841d5-9a19-424f-926f-7fca01106312",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T12:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T12:05:06.000Z",
      "valid_until": "2026-05-29T12:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-27T11:16:16.687Z",
      "x_nadsec_last_seen": "2026-04-30T02:15:31.068Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-27T13:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--0de44d56-cb4e-4fc7-9ae2-d1b86354781e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T13:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '101.36.107.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T13:05:19.000Z",
      "valid_until": "2026-05-29T13:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-27T13:04:18.365Z",
      "x_nadsec_last_seen": "2026-04-29T19:09:16.988Z",
      "x_nadsec_ports": [
        "27017",
        "3306"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-27T13:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--19b9e8ec-c5fb-4e4e-b414-ec63f6d38dcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T13:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.118.202.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T13:05:19.000Z",
      "valid_until": "2026-05-29T13:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-27T12:18:05.548Z",
      "x_nadsec_last_seen": "2026-04-27T12:18:06.264Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-27T13:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--87975762-9637-44fb-aa5b-58fa31a5c7b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T13:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.62.134.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T13:05:19.000Z",
      "valid_until": "2026-05-29T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T12:38:16.331Z",
      "x_nadsec_last_seen": "2026-04-27T12:38:16.331Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-27T13:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=32; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--9e8ae403-783e-44d9-8c23-9b60e9d51c94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T13:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.195.232.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T13:05:19.000Z",
      "valid_until": "2026-05-29T13:05:09.000Z",
      "x_nadsec_event_count": 32,
      "x_nadsec_first_seen": "2026-04-27T12:18:10.190Z",
      "x_nadsec_last_seen": "2026-04-27T12:22:28.198Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-27T13:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=mongod; ports=27017; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--29a6f0bd-d1c7-4aaf-a79b-4a028dc425e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T13:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T13:05:19.000Z",
      "valid_until": "2026-05-29T13:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-04-27T12:37:38.956Z",
      "x_nadsec_last_seen": "2026-04-27T12:37:58.753Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-04-27T13:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--28de8cf3-d7bd-4a42-85c0-9f42f8886811",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T13:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.227.49.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T13:05:19.000Z",
      "valid_until": "2026-05-29T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T13:03:24.444Z",
      "x_nadsec_last_seen": "2026-04-27T13:03:24.444Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-27T13:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--a5432210-a65c-4cc6-b92d-72d3701e0361",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T13:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T13:05:19.000Z",
      "valid_until": "2026-05-29T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T12:40:23.229Z",
      "x_nadsec_last_seen": "2026-04-27T12:40:23.229Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-27T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=httpd; ports=81; cc=SC; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--a4489480-851c-4fad-9e58-dfc4d751664c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T15:05:02.000Z",
      "valid_until": "2026-05-29T15:05:01.000Z",
      "x_nadsec_event_count": 25,
      "x_nadsec_first_seen": "2026-04-27T14:55:01.659Z",
      "x_nadsec_last_seen": "2026-04-27T15:27:54.336Z",
      "x_nadsec_ports": [
        "81",
        "135",
        "1433",
        "1723",
        "27017",
        "21",
        "445",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd",
        "mongod",
        "mssqld",
        "pptpd",
        "ftpd",
        "mqttd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-04-27T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--2f83319e-2ed4-4b8a-9b28-aebcc52b9828",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.76.116.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T15:05:02.000Z",
      "valid_until": "2026-05-29T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-27T14:25:46.963Z",
      "x_nadsec_last_seen": "2026-04-27T14:26:08.738Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-27T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--5d580913-1835-4157-a868-b7f52681d2f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.76.224.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T15:05:02.000Z",
      "valid_until": "2026-05-29T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T14:25:40.253Z",
      "x_nadsec_last_seen": "2026-04-27T14:25:40.253Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-27T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--46a26322-ea99-43f9-ae21-3cbae08e990a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T15:05:02.000Z",
      "valid_until": "2026-05-29T15:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-22T15:38:09.134Z",
      "x_nadsec_last_seen": "2026-04-27T14:52:59.715Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-27T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--051960ba-2a5a-4e84-bafe-9159fdf74e62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.248.243.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T16:05:03.000Z",
      "valid_until": "2026-05-29T16:05:01.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-04-27T15:31:20.814Z",
      "x_nadsec_last_seen": "2026-04-27T15:32:23.505Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-27T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--72eae20a-15ed-4e1a-af84-ab9c9738618f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '134.209.242.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T16:05:03.000Z",
      "valid_until": "2026-05-29T16:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-27T15:32:31.332Z",
      "x_nadsec_last_seen": "2026-04-27T15:32:31.900Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-27T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=pptpd; ports=1723; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--aa9aa233-a5cd-42ae-90e6-0713e10b3af4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.206.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T16:05:03.000Z",
      "valid_until": "2026-05-29T16:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-27T15:42:56.192Z",
      "x_nadsec_last_seen": "2026-04-27T15:43:08.055Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-27T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--9580090e-64a0-42ff-9b19-1c32297d796e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.210.53.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T16:05:03.000Z",
      "valid_until": "2026-05-29T16:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-27T15:32:56.317Z",
      "x_nadsec_last_seen": "2026-04-27T15:42:55.357Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-04-27T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=32; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--01de726c-b64a-4632-b7b3-58703a149b44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.195.210.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T16:05:03.000Z",
      "valid_until": "2026-05-29T16:05:01.000Z",
      "x_nadsec_event_count": 32,
      "x_nadsec_first_seen": "2026-04-27T15:13:09.803Z",
      "x_nadsec_last_seen": "2026-04-27T15:17:27.763Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-27T17:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=136093; asn_org=PT Mitra Lintas Multimedia",
      "id": "indicator--2f18ea50-f3e9-47c7-a711-9433184860a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T17:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.111.100.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T17:05:04.000Z",
      "valid_until": "2026-05-29T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T16:45:42.887Z",
      "x_nadsec_last_seen": "2026-04-27T16:45:42.887Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "136093"
      ],
      "x_nadsec_orgs": [
        "PT Mitra Lintas Multimedia"
      ]
    },
    {
      "created": "2026-04-27T17:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--14426cf0-352a-433e-901e-10fffa9b5d75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T17:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.161.66.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T17:05:04.000Z",
      "valid_until": "2026-05-29T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T16:49:41.118Z",
      "x_nadsec_last_seen": "2026-04-27T16:49:41.118Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-27T17:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--254fe7e9-c89b-40a7-b17f-7b9a3aae3ec8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T17:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '115.79.200.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T17:05:04.000Z",
      "valid_until": "2026-05-29T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-27T16:54:02.931Z",
      "x_nadsec_last_seen": "2026-04-27T16:56:08.100Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-04-27T17:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--64a1d319-e416-46c8-bcaf-b74dd64ab01a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T17:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T17:05:04.000Z",
      "valid_until": "2026-05-29T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T16:33:56.372Z",
      "x_nadsec_last_seen": "2026-04-27T16:33:56.372Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-27T17:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=11562; asn_org=Net Uno, C.A.",
      "id": "indicator--640c9131-c4f4-4875-9b95-b7187bf80484",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T17:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.6.12.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T17:05:04.000Z",
      "valid_until": "2026-05-29T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-27T16:20:19.715Z",
      "x_nadsec_last_seen": "2026-04-27T16:22:34.350Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "11562"
      ],
      "x_nadsec_orgs": [
        "Net Uno, C.A."
      ]
    },
    {
      "created": "2026-04-27T17:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=28618; asn_org=Linktel Telecom do Brasil Ltda",
      "id": "indicator--188c8ede-3cc1-4e08-9630-58a56c4b455a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T17:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '201.54.235.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T17:05:04.000Z",
      "valid_until": "2026-05-29T17:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-27T16:14:05.761Z",
      "x_nadsec_last_seen": "2026-04-27T16:14:05.848Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28618"
      ],
      "x_nadsec_orgs": [
        "Linktel Telecom do Brasil Ltda"
      ]
    },
    {
      "created": "2026-04-27T17:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--13ad029e-179b-4150-b1c3-9bdaf844f78d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T17:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.14.21.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T17:05:04.000Z",
      "valid_until": "2026-05-29T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T16:53:26.683Z",
      "x_nadsec_last_seen": "2026-04-27T16:53:26.683Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-27T17:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=24955; asn_org=JSC Ufanet",
      "id": "indicator--d5978b06-5f67-405b-b9df-18d14217ea88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T17:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '77.79.191.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T17:05:04.000Z",
      "valid_until": "2026-05-29T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-27T16:06:44.144Z",
      "x_nadsec_last_seen": "2026-04-27T16:08:50.686Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "24955"
      ],
      "x_nadsec_orgs": [
        "JSC Ufanet"
      ]
    },
    {
      "created": "2026-04-27T17:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=8359; asn_org=MTS PJSC",
      "id": "indicator--0ce34643-64aa-4a50-af55-0118fe5a93d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T17:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '95.64.170.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T17:05:04.000Z",
      "valid_until": "2026-05-29T17:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-27T16:05:45.407Z",
      "x_nadsec_last_seen": "2026-04-27T16:09:11.972Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8359"
      ],
      "x_nadsec_orgs": [
        "MTS PJSC"
      ]
    },
    {
      "created": "2026-04-27T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--eeeabcee-7cb1-4a82-ae17-5566f17fd12c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '124.29.223.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T18:05:03.000Z",
      "valid_until": "2026-05-29T18:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-27T17:24:50.228Z",
      "x_nadsec_last_seen": "2026-04-27T17:26:56.584Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ]
    },
    {
      "created": "2026-04-27T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--48f4b9e7-b3d6-4d12-ab14-0500d663c4d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.163.159.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T18:05:03.000Z",
      "valid_until": "2026-05-29T18:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-27T18:03:48.003Z",
      "x_nadsec_last_seen": "2026-04-27T18:03:50.919Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-04-27T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--b5e66a96-0398-4705-ae2e-305cb08fd45f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '92.127.45.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T18:05:03.000Z",
      "valid_until": "2026-05-29T18:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-27T17:46:38.915Z",
      "x_nadsec_last_seen": "2026-04-27T17:48:46.030Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-27T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--a1f78c8e-1cd2-4e5e-880a-488a73cf9c8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.20.73.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T19:05:11.000Z",
      "valid_until": "2026-05-29T19:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-27T18:25:50.480Z",
      "x_nadsec_last_seen": "2026-04-27T18:27:57.164Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-04-27T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--5e552172-1ef7-4a26-bd20-f37cd72931da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T19:05:11.000Z",
      "valid_until": "2026-05-29T19:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T18:26:50.169Z",
      "x_nadsec_last_seen": "2026-04-27T18:26:50.169Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-27T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--29b3442f-f06a-48d9-9acf-5c1876ccc730",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.126.124.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T19:05:11.000Z",
      "valid_until": "2026-05-29T19:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-27T18:50:53.203Z",
      "x_nadsec_last_seen": "2026-04-27T18:53:00.111Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-27T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--9c9f44ea-a4f8-4f2f-9918-97a835615f0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.197.118.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T20:05:10.000Z",
      "valid_until": "2026-05-29T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T19:36:57.395Z",
      "x_nadsec_last_seen": "2026-04-27T19:36:57.395Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-27T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED; user(top)=r**t",
      "id": "indicator--7d9835c7-ff1e-4a30-b343-24e213c60012",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.233.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T20:05:10.000Z",
      "valid_until": "2026-05-29T20:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-27T19:47:50.276Z",
      "x_nadsec_last_seen": "2026-04-27T19:48:13.340Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-27T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=266445; asn_org=SEA TELECOM LTDA",
      "id": "indicator--73891ac7-6e28-4668-aa20-8a630f4b6106",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '170.82.183.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T20:05:10.000Z",
      "valid_until": "2026-05-29T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-27T19:58:57.263Z",
      "x_nadsec_last_seen": "2026-04-27T20:01:04.335Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "266445"
      ],
      "x_nadsec_orgs": [
        "SEA TELECOM LTDA"
      ]
    },
    {
      "created": "2026-04-27T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=137; services=smbd; ports=445; cc=GB; asn=201579; asn_org=Hostgnome Ltd",
      "id": "indicator--9cf71a34-9f03-44a7-9927-9c1a819eaa81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.91.69.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T20:05:10.000Z",
      "valid_until": "2026-05-29T20:05:09.000Z",
      "x_nadsec_event_count": 137,
      "x_nadsec_first_seen": "2026-04-27T19:15:13.682Z",
      "x_nadsec_last_seen": "2026-04-27T19:54:42.011Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "201579"
      ],
      "x_nadsec_orgs": [
        "Hostgnome Ltd"
      ]
    },
    {
      "created": "2026-04-27T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=788; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--f9748e05-4f3c-41a9-8084-c92a295e7e5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.148.33.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T20:05:10.000Z",
      "valid_until": "2026-05-29T20:05:09.000Z",
      "x_nadsec_event_count": 11069,
      "x_nadsec_first_seen": "2026-04-27T19:51:25.656Z",
      "x_nadsec_last_seen": "2026-04-27T22:07:14.303Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-04-27T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--8ef60ff9-e7dd-4c95-b57f-11b6ee38a00f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T20:05:10.000Z",
      "valid_until": "2026-05-29T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-27T20:02:32.156Z",
      "x_nadsec_last_seen": "2026-04-28T16:15:44.721Z",
      "x_nadsec_ports": [
        "135",
        "1433"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-27T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--f7cc5953-92ff-4318-a043-cc0424e31f9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T20:05:10.000Z",
      "valid_until": "2026-05-29T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T19:29:01.737Z",
      "x_nadsec_last_seen": "2026-04-27T19:29:01.737Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-27T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--88dd206c-0548-43e5-979a-970f730a4c72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T20:05:10.000Z",
      "valid_until": "2026-05-29T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T19:29:02.075Z",
      "x_nadsec_last_seen": "2026-04-27T19:29:02.075Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-27T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--dcaa3ca9-a863-4a57-82fe-5714ace5bb01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '137.184.212.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T22:05:10.000Z",
      "valid_until": "2026-05-29T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-27T21:29:08.981Z",
      "x_nadsec_last_seen": "2026-04-27T21:29:20.265Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-27T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a6f8f241-9619-4314-b2a7-df95f949917d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '161.35.11.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T22:05:10.000Z",
      "valid_until": "2026-05-29T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T21:29:21.243Z",
      "x_nadsec_last_seen": "2026-04-27T21:29:21.243Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-27T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--96b36f60-555b-4517-bc48-2c6e90716c85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.11.153.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T22:05:10.000Z",
      "valid_until": "2026-05-29T22:05:09.000Z",
      "x_nadsec_event_count": 45,
      "x_nadsec_first_seen": "2026-04-27T21:14:17.725Z",
      "x_nadsec_last_seen": "2026-04-27T21:16:06.369Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-04-27T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--a23ce0da-2c61-4c9c-89c6-5c8f25c5ae40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.74.52.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T22:05:10.000Z",
      "valid_until": "2026-05-29T22:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-27T21:25:14.842Z",
      "x_nadsec_last_seen": "2026-04-27T21:32:14.167Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-04-27T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=DE; asn=215929; asn_org=Data Campus Limited",
      "id": "indicator--1bab34f9-646c-4fe0-ae7d-9a1afa441596",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '193.24.211.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T23:05:02.000Z",
      "valid_until": "2026-05-29T23:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-27T22:36:04.198Z",
      "x_nadsec_last_seen": "2026-04-27T23:11:58.927Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "215929"
      ],
      "x_nadsec_orgs": [
        "Data Campus Limited"
      ]
    },
    {
      "created": "2026-04-27T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IT; asn=12874; asn_org=Fastweb",
      "id": "indicator--70df4b66-e254-4af9-9da3-c1f622b436fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.186.209.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T23:05:02.000Z",
      "valid_until": "2026-05-29T23:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T22:41:18.640Z",
      "x_nadsec_last_seen": "2026-04-27T22:41:18.640Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "12874"
      ],
      "x_nadsec_orgs": [
        "Fastweb"
      ]
    },
    {
      "created": "2026-04-27T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--79da95ce-962b-4b53-8795-4f054f56f968",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.245.143.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T23:05:02.000Z",
      "valid_until": "2026-05-29T23:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T22:36:35.171Z",
      "x_nadsec_last_seen": "2026-04-27T22:36:35.171Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-28T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=134420; asn_org=Chongqing Telecom",
      "id": "indicator--515967bb-88ea-468d-8b42-f535f7ee64fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.249.101.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T00:05:10.000Z",
      "valid_until": "2026-05-30T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-27T23:18:52.313Z",
      "x_nadsec_last_seen": "2026-04-27T23:18:52.413Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "134420"
      ],
      "x_nadsec_orgs": [
        "Chongqing Telecom"
      ]
    },
    {
      "created": "2026-04-28T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mssqld; ports=1433; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--5b866853-118b-493b-b8a2-533eec0e7469",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.207.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T00:05:10.000Z",
      "valid_until": "2026-05-30T00:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-27T23:41:47.062Z",
      "x_nadsec_last_seen": "2026-04-27T23:42:44.506Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-28T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MX; asn=8151; asn_org=UNINET; user(top)=**",
      "id": "indicator--a215e55f-a08a-4913-a6e5-2ebf5491868c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.229.77.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T00:05:10.000Z",
      "valid_until": "2026-05-30T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-27T23:08:08.745Z",
      "x_nadsec_last_seen": "2026-04-27T23:08:08.745Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-28T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=17; services=ftpd; ports=21; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; user(top)=***; pass(top)=***",
      "id": "indicator--592f374f-1482-436f-a172-5fe30c450373",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '60.205.150.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T00:05:10.000Z",
      "valid_until": "2026-05-30T00:05:09.000Z",
      "x_nadsec_event_count": 856,
      "x_nadsec_first_seen": "2026-04-27T23:55:17.496Z",
      "x_nadsec_last_seen": "2026-04-28T08:23:20.567Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "A***n",
        "a***********r",
        "d**a",
        "**",
        "***"
      ],
      "x_nadsec_passwords_attempted": [
        "a*******s",
        "0****0",
        "1****1",
        "1**4",
        "1***5"
      ]
    },
    {
      "created": "2026-04-28T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=41435; asn_org=UnderNet LLC",
      "id": "indicator--b7a0160f-e079-4f2d-a6a6-d070da794f58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.110.133.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T00:05:10.000Z",
      "valid_until": "2026-05-30T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-27T23:53:48.569Z",
      "x_nadsec_last_seen": "2026-04-27T23:55:54.531Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "41435"
      ],
      "x_nadsec_orgs": [
        "UnderNet LLC"
      ]
    },
    {
      "created": "2026-04-28T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=25490; asn_org=Rostelecom",
      "id": "indicator--3334f9d1-1815-46d3-aacd-555e2084d94d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '83.239.77.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T00:05:10.000Z",
      "valid_until": "2026-05-30T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-28T00:03:02.227Z",
      "x_nadsec_last_seen": "2026-04-28T00:04:41.694Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25490"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-28T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--649d9faf-b63d-4aea-9b2d-c294f7efd1d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '123.17.157.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T02:05:03.000Z",
      "valid_until": "2026-05-30T02:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-28T01:54:04.391Z",
      "x_nadsec_last_seen": "2026-04-28T01:56:09.153Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-28T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--e8e6427d-783b-4a0f-8bba-18ac57e2058b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.110.109.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T02:05:03.000Z",
      "valid_until": "2026-05-30T02:05:01.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-04-28T01:51:43.294Z",
      "x_nadsec_last_seen": "2026-04-28T01:52:44.458Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "*"
      ]
    },
    {
      "created": "2026-04-28T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=53006; asn_org=ALGAR TELECOM SA",
      "id": "indicator--af1da87b-afd8-42f4-bd69-0cc149920477",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.41.17.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T02:05:03.000Z",
      "valid_until": "2026-05-30T02:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-28T01:45:52.899Z",
      "x_nadsec_last_seen": "2026-04-28T01:45:52.974Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "53006"
      ],
      "x_nadsec_orgs": [
        "ALGAR TELECOM SA"
      ]
    },
    {
      "created": "2026-04-28T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PL; asn=21021; asn_org=Multimedia Polska Sp. z o.o.",
      "id": "indicator--773139ab-95e0-484c-bd65-caaf6e0b014c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '193.43.240.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T02:05:03.000Z",
      "valid_until": "2026-05-30T02:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-28T01:15:23.839Z",
      "x_nadsec_last_seen": "2026-04-28T01:19:43.307Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "21021"
      ],
      "x_nadsec_orgs": [
        "Multimedia Polska Sp. z o.o."
      ]
    },
    {
      "created": "2026-04-28T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--c1ee61ab-158b-4fc0-b5a7-4cac825e903d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T02:05:03.000Z",
      "valid_until": "2026-05-30T02:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T01:28:51.249Z",
      "x_nadsec_last_seen": "2026-04-28T01:28:51.249Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-04-28T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e4862d7a-4014-4487-8d47-1f980007779e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.202.118.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T03:05:11.000Z",
      "valid_until": "2026-05-30T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-28T03:01:25.683Z",
      "x_nadsec_last_seen": "2026-04-28T03:01:35.859Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-28T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--823ba1de-f7b7-4464-9591-515a1b61f52a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.29.49.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T03:05:11.000Z",
      "valid_until": "2026-05-30T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-28T02:32:26.246Z",
      "x_nadsec_last_seen": "2026-04-28T02:32:36.422Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-28T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=50219; asn_org=Valence Technology Co.",
      "id": "indicator--b933a317-3678-4f88-9822-2bfa70680431",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '216.226.76.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T03:05:11.000Z",
      "valid_until": "2026-05-30T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T02:37:11.918Z",
      "x_nadsec_last_seen": "2026-04-28T02:37:11.918Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "50219"
      ],
      "x_nadsec_orgs": [
        "Valence Technology Co."
      ]
    },
    {
      "created": "2026-04-28T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--39e6582b-c0b7-435e-a08c-4e915f78c5b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.53.133.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T03:05:11.000Z",
      "valid_until": "2026-05-30T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-28T02:24:55.009Z",
      "x_nadsec_last_seen": "2026-04-28T02:25:27.740Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-04-28T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--6564e1c8-b2ff-4350-be89-6696eb48eeaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.78.18.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T03:05:11.000Z",
      "valid_until": "2026-05-30T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T02:24:15.351Z",
      "x_nadsec_last_seen": "2026-04-28T02:24:15.351Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-28T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=133481; asn_org=AIS Fibre",
      "id": "indicator--508fdc82-bf1c-4a9d-8b9c-b43859e58ea1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '49.228.104.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T03:05:11.000Z",
      "valid_until": "2026-05-30T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-28T02:35:06.476Z",
      "x_nadsec_last_seen": "2026-04-28T02:37:10.911Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "133481"
      ],
      "x_nadsec_orgs": [
        "AIS Fibre"
      ]
    },
    {
      "created": "2026-04-28T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--13e2fc93-564e-45db-b325-f524ef0fa609",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '164.92.192.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T04:05:03.000Z",
      "valid_until": "2026-05-30T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-28T03:23:49.865Z",
      "x_nadsec_last_seen": "2026-04-28T03:23:53.171Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-28T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6e4e7c74-33dc-4c49-b721-578814cf40e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '174.138.46.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T04:05:03.000Z",
      "valid_until": "2026-05-30T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T03:15:37.606Z",
      "x_nadsec_last_seen": "2026-04-28T03:15:37.606Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-28T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--771fe519-8909-42fa-97f6-14db309ac743",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '180.252.237.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T04:05:03.000Z",
      "valid_until": "2026-05-30T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-28T03:37:34.142Z",
      "x_nadsec_last_seen": "2026-04-28T03:39:39.743Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-28T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--7b5676e1-7578-42d9-9b91-7f3e61df881e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.219.134.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T04:05:03.000Z",
      "valid_until": "2026-05-30T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T03:50:11.667Z",
      "x_nadsec_last_seen": "2026-04-28T03:50:11.667Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-28T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--36d4dea8-20e2-478a-9672-038b3dc53a0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.199.87.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T04:05:03.000Z",
      "valid_until": "2026-05-30T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T03:15:36.872Z",
      "x_nadsec_last_seen": "2026-04-28T03:15:36.872Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-28T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CA; asn=16276; asn_org=OVH SAS; user(top)=**",
      "id": "indicator--f1776c5f-4729-4bf7-a392-acd6bc7b35bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '51.161.13.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T04:05:03.000Z",
      "valid_until": "2026-05-30T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-26T08:29:40.086Z",
      "x_nadsec_last_seen": "2026-04-28T03:47:12.225Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-28T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=140475; asn_org=PT Citra Celebas Multimedia",
      "id": "indicator--90f6fbfa-c48e-45aa-921c-cf416c79c1f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '82.39.174.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T04:05:03.000Z",
      "valid_until": "2026-05-30T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-28T03:05:32.138Z",
      "x_nadsec_last_seen": "2026-04-28T03:05:34.682Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "140475"
      ],
      "x_nadsec_orgs": [
        "PT Citra Celebas Multimedia"
      ]
    },
    {
      "created": "2026-04-28T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrord; ports=42; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--d5e0d968-36e3-4253-99d1-3374e5bce0cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T04:05:03.000Z",
      "valid_until": "2026-05-30T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-28T03:19:51.260Z",
      "x_nadsec_last_seen": "2026-04-28T03:19:51.263Z",
      "x_nadsec_ports": [
        "42",
        "41219"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-28T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--ebd3a08e-fcd6-4dff-806e-65c237bddeff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T04:05:03.000Z",
      "valid_until": "2026-05-30T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T03:27:57.877Z",
      "x_nadsec_last_seen": "2026-04-28T03:27:57.877Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-28T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--effc7c63-71f1-452f-ac78-23af0cf6311c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T04:05:03.000Z",
      "valid_until": "2026-05-30T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T03:29:02.459Z",
      "x_nadsec_last_seen": "2026-04-28T03:29:02.459Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-28T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=AR; asn=11664; asn_org=Techtel LMDS Comunicaciones Interactivas S.A.",
      "id": "indicator--3e37172a-60da-40c2-b202-550b11a640af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.182.7.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T05:05:10.000Z",
      "valid_until": "2026-05-30T05:05:09.000Z",
      "x_nadsec_event_count": 3166,
      "x_nadsec_first_seen": "2026-04-28T04:06:30.747Z",
      "x_nadsec_last_seen": "2026-04-28T07:10:30.791Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "11664"
      ],
      "x_nadsec_orgs": [
        "Techtel LMDS Comunicaciones Interactivas S.A."
      ]
    },
    {
      "created": "2026-04-28T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--75ed3ee3-577f-4f41-81a0-5e6e97dbf020",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.232.40.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T05:05:10.000Z",
      "valid_until": "2026-05-30T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-28T04:39:43.874Z",
      "x_nadsec_last_seen": "2026-04-28T04:39:43.962Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-04-28T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PE; asn=27843; asn_org=WIN EMPRESAS S.A.C.",
      "id": "indicator--9c73d372-12e7-40a2-8b98-a9f7d0de7c41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.102.157.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T05:05:10.000Z",
      "valid_until": "2026-05-30T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-28T04:13:48.404Z",
      "x_nadsec_last_seen": "2026-04-28T04:15:54.540Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "27843"
      ],
      "x_nadsec_orgs": [
        "WIN EMPRESAS S.A.C."
      ]
    },
    {
      "created": "2026-04-28T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=24525; asn_org=PT Solusi Aksesindo Pratama",
      "id": "indicator--5a34707c-b2ec-481a-8031-5cea648ca9a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '114.199.107.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T06:05:02.000Z",
      "valid_until": "2026-05-30T06:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-28T05:10:33.395Z",
      "x_nadsec_last_seen": "2026-04-28T05:10:36.598Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "24525"
      ],
      "x_nadsec_orgs": [
        "PT Solusi Aksesindo Pratama"
      ]
    },
    {
      "created": "2026-04-28T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=GB; asn=215540; asn_org=Global Connectivity Solutions Llp",
      "id": "indicator--98dbcd48-ebda-413d-9111-e090935747c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.45.179.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T06:05:02.000Z",
      "valid_until": "2026-05-30T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T05:55:31.166Z",
      "x_nadsec_last_seen": "2026-04-28T05:55:31.166Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "215540"
      ],
      "x_nadsec_orgs": [
        "Global Connectivity Solutions Llp"
      ]
    },
    {
      "created": "2026-04-28T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--55f9828f-d218-47f5-9940-c4012ea21745",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.97.19.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T06:05:02.000Z",
      "valid_until": "2026-05-30T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T05:28:22.443Z",
      "x_nadsec_last_seen": "2026-04-28T05:28:22.443Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-28T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=2561; asn_org=EUN",
      "id": "indicator--a25859f2-2d9b-43d6-9203-67a5294be3cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '193.227.49.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T06:05:02.000Z",
      "valid_until": "2026-05-30T06:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-28T05:10:44.759Z",
      "x_nadsec_last_seen": "2026-04-28T05:17:59.686Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "2561"
      ],
      "x_nadsec_orgs": [
        "EUN"
      ]
    },
    {
      "created": "2026-04-28T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--fc77c6b7-7f87-478c-a46e-bec49fa2765f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.102.116.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T06:05:02.000Z",
      "valid_until": "2026-05-30T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T05:40:33.141Z",
      "x_nadsec_last_seen": "2026-04-28T05:40:33.141Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-28T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--bc5a03dd-88c0-4760-a6ce-70ae31bac1fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.202.18.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T07:05:11.000Z",
      "valid_until": "2026-05-30T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-28T06:53:17.218Z",
      "x_nadsec_last_seen": "2026-04-28T06:53:17.259Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-28T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--b1ba231d-a484-4151-b41f-bf8a905f370c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.84.112.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T07:05:11.000Z",
      "valid_until": "2026-05-30T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-28T06:19:50.284Z",
      "x_nadsec_last_seen": "2026-04-28T06:21:55.333Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-28T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--719367e2-a0e2-44d9-bc36-eaef04be074a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T07:05:11.000Z",
      "valid_until": "2026-05-30T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-28T06:56:16.625Z",
      "x_nadsec_last_seen": "2026-04-28T06:56:18.856Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-28T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IL; asn=12400; asn_org=Partner Communications Ltd.",
      "id": "indicator--c2631f01-843c-401a-a981-18dea6d07732",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '80.179.153.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T07:05:11.000Z",
      "valid_until": "2026-05-30T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-28T06:29:30.120Z",
      "x_nadsec_last_seen": "2026-04-28T06:36:50.055Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IL"
      ],
      "x_nadsec_asns": [
        "12400"
      ],
      "x_nadsec_orgs": [
        "Partner Communications Ltd."
      ]
    },
    {
      "created": "2026-04-28T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0c323a3c-4a0d-4bce-bdd7-6d6f285bde72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.211.105.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T08:05:02.000Z",
      "valid_until": "2026-05-30T08:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T07:54:45.986Z",
      "x_nadsec_last_seen": "2026-04-28T07:54:45.986Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-28T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=GB; asn=201002; asn_org=PebbleHost Ltd",
      "id": "indicator--47b386e2-1728-46e8-ac5a-da91f82cf2f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T08:05:02.000Z",
      "valid_until": "2026-05-30T08:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-28T00:10:28.211Z",
      "x_nadsec_last_seen": "2026-04-28T07:19:54.209Z",
      "x_nadsec_ports": [
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "201002"
      ],
      "x_nadsec_orgs": [
        "PebbleHost Ltd"
      ]
    },
    {
      "created": "2026-04-28T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--bff4c7ab-8f61-4122-ae3c-6837dce53e5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.168.121.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T09:05:04.000Z",
      "valid_until": "2026-05-30T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T08:14:25.481Z",
      "x_nadsec_last_seen": "2026-04-28T08:14:25.481Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-28T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--16e4b43b-2f20-427b-9031-e527409eba19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '98.90.43.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T09:05:04.000Z",
      "valid_until": "2026-05-30T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T08:26:49.349Z",
      "x_nadsec_last_seen": "2026-04-28T08:26:49.349Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-28T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=NL; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--d65a4b10-42b6-446b-9662-1d5b6739a080",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.248.201.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T10:05:03.000Z",
      "valid_until": "2026-05-30T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T09:34:02.543Z",
      "x_nadsec_last_seen": "2026-04-28T09:34:02.543Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-28T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=28227; asn_org=NOVACIA TECNOLOGIA E TELECOMUNICACOES LTDA",
      "id": "indicator--b1bcf7dd-fffa-44e0-a35d-554f0995cb58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.209.190.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T10:05:03.000Z",
      "valid_until": "2026-05-30T10:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-28T09:54:21.728Z",
      "x_nadsec_last_seen": "2026-04-28T09:54:22.070Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28227"
      ],
      "x_nadsec_orgs": [
        "NOVACIA TECNOLOGIA E TELECOMUNICACOES LTDA"
      ]
    },
    {
      "created": "2026-04-28T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--7526fd02-88e9-4da2-abd6-d3c17fd013aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.15.224.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T10:05:03.000Z",
      "valid_until": "2026-05-30T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T10:00:01.607Z",
      "x_nadsec_last_seen": "2026-04-28T10:00:01.607Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-28T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c13d087f-e9c6-406f-922a-84a656a5c71e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.124.174.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T10:05:03.000Z",
      "valid_until": "2026-05-30T10:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-28T09:28:12.242Z",
      "x_nadsec_last_seen": "2026-04-28T09:28:22.596Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-28T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8fb4a551-36b5-4326-a123-d068af1a6709",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T10:05:03.000Z",
      "valid_until": "2026-05-30T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T09:31:19.226Z",
      "x_nadsec_last_seen": "2026-04-28T09:31:19.226Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-28T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--97bd8d98-f92b-4a81-a4d1-85f098e64d6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.177.145.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T11:05:03.000Z",
      "valid_until": "2026-05-30T11:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-28T10:45:55.830Z",
      "x_nadsec_last_seen": "2026-04-28T10:48:02.255Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-28T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--d59abdf2-517b-4b8d-91d9-774cabb1cdae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.211.19.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T11:05:03.000Z",
      "valid_until": "2026-05-30T11:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-28T10:32:13.674Z",
      "x_nadsec_last_seen": "2026-04-28T10:32:21.282Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-28T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--28505e21-022e-43f0-8b55-6b886ae2ced0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T11:05:03.000Z",
      "valid_until": "2026-05-30T11:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T10:57:45.224Z",
      "x_nadsec_last_seen": "2026-04-28T10:57:45.224Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-04-28T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=46023; asn_org=PT Quantum Tera Network",
      "id": "indicator--7e8b8b81-a909-400c-b831-de30ccddd0cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.106.76.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T12:05:11.000Z",
      "valid_until": "2026-05-30T12:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-28T11:43:06.965Z",
      "x_nadsec_last_seen": "2026-04-28T11:49:17.279Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "46023"
      ],
      "x_nadsec_orgs": [
        "PT Quantum Tera Network"
      ]
    },
    {
      "created": "2026-04-28T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=55933; asn_org=Cloudie Limited; user(top)=**",
      "id": "indicator--ba27dac5-5c81-4177-a132-ca734d1b777e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.115.50.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T12:05:11.000Z",
      "valid_until": "2026-05-30T12:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T11:44:56.198Z",
      "x_nadsec_last_seen": "2026-04-28T11:44:56.198Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "55933"
      ],
      "x_nadsec_orgs": [
        "Cloudie Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-28T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--364dc00d-b531-4692-ab69-6e0974d4e3df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.80.105.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T12:05:11.000Z",
      "valid_until": "2026-05-30T12:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T11:49:55.680Z",
      "x_nadsec_last_seen": "2026-04-28T11:49:55.680Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-28T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=JP; asn=4713; asn_org=NTT DOCOMO BUSINESS,Inc.",
      "id": "indicator--7428ce10-2b70-4545-97eb-841054ac9691",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '210.225.99.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T12:05:11.000Z",
      "valid_until": "2026-05-30T12:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-28T11:23:11.209Z",
      "x_nadsec_last_seen": "2026-04-28T11:23:14.976Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "4713"
      ],
      "x_nadsec_orgs": [
        "NTT DOCOMO BUSINESS,Inc."
      ]
    },
    {
      "created": "2026-04-28T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--a2e8bba0-a1b6-49fb-ad98-a58e33e66902",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.250.175.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T12:05:11.000Z",
      "valid_until": "2026-05-30T12:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-28T11:54:07.479Z",
      "x_nadsec_last_seen": "2026-04-28T11:54:31.044Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-28T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=AZ; asn=8814; asn_org=Aztelekom LLC; user(top)=**",
      "id": "indicator--d3f5a9e8-16e3-403e-b603-bfe707f67634",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '80.69.55.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T12:05:11.000Z",
      "valid_until": "2026-05-30T12:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T11:43:01.208Z",
      "x_nadsec_last_seen": "2026-04-28T11:43:01.208Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "8814"
      ],
      "x_nadsec_orgs": [
        "Aztelekom LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-28T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--cdb71c99-18d0-4322-9fe4-93e103b58fc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.100.42.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T12:05:11.000Z",
      "valid_until": "2026-05-30T12:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-28T11:58:37.287Z",
      "x_nadsec_last_seen": "2026-04-28T12:05:16.896Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-04-28T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=GB; asn=201002; asn_org=PebbleHost Ltd",
      "id": "indicator--e482bcba-4809-4b02-97ab-175d683befe1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T12:05:11.000Z",
      "valid_until": "2026-05-30T12:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-28T11:15:26.574Z",
      "x_nadsec_last_seen": "2026-04-28T11:15:42.179Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "201002"
      ],
      "x_nadsec_orgs": [
        "PebbleHost Ltd"
      ]
    },
    {
      "created": "2026-04-28T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--08e7fd84-cf8d-4b58-9763-f334dc8f6bf8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.198.72.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T14:05:10.000Z",
      "valid_until": "2026-05-30T14:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-28T13:58:49.912Z",
      "x_nadsec_last_seen": "2026-04-28T14:05:36.969Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-04-28T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TN; asn=2609; asn_org=TN-BB-AS Tunisia BackBone AS",
      "id": "indicator--9c885074-4a45-41e9-8caa-7013134d281f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.203.252.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T14:05:10.000Z",
      "valid_until": "2026-05-30T14:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-28T13:48:28.371Z",
      "x_nadsec_last_seen": "2026-04-28T13:52:04.705Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "2609"
      ],
      "x_nadsec_orgs": [
        "TN-BB-AS Tunisia BackBone AS"
      ]
    },
    {
      "created": "2026-04-28T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--5960d2b7-90eb-4d41-85d3-957eef073866",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.14.73.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T14:05:10.000Z",
      "valid_until": "2026-05-30T14:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-28T13:18:40.225Z",
      "x_nadsec_last_seen": "2026-04-28T13:18:50.369Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-28T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--4d06f310-d2f1-4026-874a-73c4a2756221",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '201.208.159.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T14:05:10.000Z",
      "valid_until": "2026-05-30T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-28T13:23:42.645Z",
      "x_nadsec_last_seen": "2026-04-28T13:25:49.347Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-04-28T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--9c37c9fe-39ab-4f1a-921f-1b0231d7db5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T14:05:10.000Z",
      "valid_until": "2026-05-30T14:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T13:34:13.366Z",
      "x_nadsec_last_seen": "2026-04-28T13:34:13.366Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-28T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--06a631c0-03f0-49fb-a15a-4e109edeac6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T14:05:10.000Z",
      "valid_until": "2026-05-30T14:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T13:51:28.065Z",
      "x_nadsec_last_seen": "2026-04-28T13:51:28.065Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-28T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--91ddc244-2fdf-4dc6-af85-b3bdc666d6de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T14:05:10.000Z",
      "valid_until": "2026-05-30T14:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T13:51:28.304Z",
      "x_nadsec_last_seen": "2026-04-28T13:51:28.304Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-28T15:05:39.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--049bc862-6bee-4733-a28f-60f3d387464e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T15:05:39.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '188.166.172.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T15:05:39.000Z",
      "valid_until": "2026-05-30T15:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T14:24:31.112Z",
      "x_nadsec_last_seen": "2026-04-28T14:24:31.112Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-28T15:05:39.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--12239b67-42e7-4e5c-a10c-3932bf8924a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T15:05:39.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.29.58.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T15:05:39.000Z",
      "valid_until": "2026-05-30T15:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T14:37:28.263Z",
      "x_nadsec_last_seen": "2026-04-28T14:37:28.263Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-28T15:05:39.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=FR; asn=16276; asn_org=OVH SAS",
      "id": "indicator--0bfa9d0e-fdad-4447-b64d-4e9722ff4fb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T15:05:39.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.135.229.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T15:05:39.000Z",
      "valid_until": "2026-05-30T15:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T14:39:42.114Z",
      "x_nadsec_last_seen": "2026-04-28T14:39:42.114Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ]
    },
    {
      "created": "2026-04-28T16:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PL; asn=5617; asn_org=Orange Polska Spolka Akcyjna",
      "id": "indicator--81049197-7483-44c3-a579-532fb442824a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T16:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.43.11.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T16:05:07.000Z",
      "valid_until": "2026-05-30T16:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-28T15:58:39.451Z",
      "x_nadsec_last_seen": "2026-04-28T16:00:45.688Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "5617"
      ],
      "x_nadsec_orgs": [
        "Orange Polska Spolka Akcyjna"
      ]
    },
    {
      "created": "2026-04-28T16:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=36; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--d5d74cf3-cf21-4a66-9dcc-ad509681c23d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T16:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '183.17.235.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T16:05:07.000Z",
      "valid_until": "2026-05-30T16:05:00.000Z",
      "x_nadsec_event_count": 124,
      "x_nadsec_first_seen": "2026-04-28T16:01:13.275Z",
      "x_nadsec_last_seen": "2026-04-28T19:16:16.691Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-28T16:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--3389ae62-f61a-4a57-b62b-af51bf7199ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T16:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T16:05:07.000Z",
      "valid_until": "2026-05-30T16:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T15:52:43.611Z",
      "x_nadsec_last_seen": "2026-04-28T15:52:43.611Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-28T16:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--51133b72-ae9b-49e9-a894-4893e40a069c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T16:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T16:05:07.000Z",
      "valid_until": "2026-05-30T16:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T15:33:30.926Z",
      "x_nadsec_last_seen": "2026-04-28T15:33:30.926Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-28T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=138232; asn_org=Sivaan Infocom Pvt Ltd",
      "id": "indicator--ba71d01a-fa92-4231-9bda-26a27306d625",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.124.141.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T18:05:03.000Z",
      "valid_until": "2026-05-30T18:05:02.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-28T17:14:37.005Z",
      "x_nadsec_last_seen": "2026-04-28T17:22:07.677Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "138232"
      ],
      "x_nadsec_orgs": [
        "Sivaan Infocom Pvt Ltd"
      ]
    },
    {
      "created": "2026-04-28T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=23; services=mongod; ports=27017; cc=SC; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--4df11e09-bfb6-44c2-8b3b-f5386a4fcac4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T18:05:03.000Z",
      "valid_until": "2026-05-30T18:05:02.000Z",
      "x_nadsec_event_count": 28,
      "x_nadsec_first_seen": "2026-04-28T17:39:33.399Z",
      "x_nadsec_last_seen": "2026-04-28T18:31:19.200Z",
      "x_nadsec_ports": [
        "81",
        "135",
        "1433",
        "1723",
        "1883",
        "27017",
        "21",
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "pptpd",
        "ftpd",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-04-28T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--e358ff7b-705c-40fa-b0d4-8f5b6f6a441a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T18:05:03.000Z",
      "valid_until": "2026-05-30T18:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T17:37:36.044Z",
      "x_nadsec_last_seen": "2026-04-28T17:37:36.044Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-28T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=137125; asn_org=Netsat Communications Private Limited",
      "id": "indicator--ca54d6d1-f12f-4cfe-b108-47e3b05837e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '202.137.213.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T18:05:03.000Z",
      "valid_until": "2026-05-30T18:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T17:18:07.074Z",
      "x_nadsec_last_seen": "2026-04-28T17:18:07.074Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "137125"
      ],
      "x_nadsec_orgs": [
        "Netsat Communications Private Limited"
      ]
    },
    {
      "created": "2026-04-28T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=150008; asn_org=Pioneer Elabs Ltd.",
      "id": "indicator--cbce77d6-051e-412d-adcf-84abacff13e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '43.225.24.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T18:05:03.000Z",
      "valid_until": "2026-05-30T18:05:02.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-28T17:27:54.171Z",
      "x_nadsec_last_seen": "2026-04-28T17:34:36.013Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "150008"
      ],
      "x_nadsec_orgs": [
        "Pioneer Elabs Ltd."
      ]
    },
    {
      "created": "2026-04-28T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--e1c686d6-95dc-43b3-859b-f28e46752c13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '8.211.129.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T18:05:03.000Z",
      "valid_until": "2026-05-30T18:05:02.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-28T17:44:43.375Z",
      "x_nadsec_last_seen": "2026-04-28T17:45:07.145Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-28T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--cf93c68a-c298-43bc-bccc-caaf163edabd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.167.214.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T19:05:10.000Z",
      "valid_until": "2026-05-30T19:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-28T18:39:31.205Z",
      "x_nadsec_last_seen": "2026-04-28T18:46:09.351Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-28T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--bd579c42-2e22-4d01-9baf-46ff83f8530a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T19:05:10.000Z",
      "valid_until": "2026-05-30T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T18:30:47.847Z",
      "x_nadsec_last_seen": "2026-04-28T18:30:47.847Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-28T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--ffff1aa6-eddb-4d53-a928-418310a17f9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.149.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T19:05:10.000Z",
      "valid_until": "2026-05-30T19:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-09T19:18:29.103Z",
      "x_nadsec_last_seen": "2026-04-28T19:05:06.452Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-28T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--f1ce2ece-d59b-4580-8397-0a6483e0aa76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.149.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T19:05:10.000Z",
      "valid_until": "2026-05-30T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-28T18:47:01.137Z",
      "x_nadsec_last_seen": "2026-04-28T18:47:30.797Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-28T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=701; asn_org=Verizon Business",
      "id": "indicator--7c990c32-e7fe-450b-a3cc-60dd31cd8a36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.49.125.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T19:05:10.000Z",
      "valid_until": "2026-05-30T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-28T18:09:37.453Z",
      "x_nadsec_last_seen": "2026-04-28T18:11:42.703Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "701"
      ],
      "x_nadsec_orgs": [
        "Verizon Business"
      ]
    },
    {
      "created": "2026-04-28T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=20011; asn_org=NTT-DATA-Inc",
      "id": "indicator--6641a8b8-aa81-472e-85fd-36d6e7e54c58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.89.124.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T19:05:10.000Z",
      "valid_until": "2026-05-30T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-28T18:13:44.308Z",
      "x_nadsec_last_seen": "2026-04-28T18:15:53.010Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "20011"
      ],
      "x_nadsec_orgs": [
        "NTT-DATA-Inc"
      ]
    },
    {
      "created": "2026-04-28T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c64800c1-a00e-4db1-9800-dedda747ce0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.80.83.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T19:05:10.000Z",
      "valid_until": "2026-05-30T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-28T18:19:40.006Z",
      "x_nadsec_last_seen": "2026-04-28T18:19:40.715Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-28T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--302599db-48da-44cd-b16c-51bda78dae7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '113.161.164.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T20:05:02.000Z",
      "valid_until": "2026-05-30T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-28T19:46:20.114Z",
      "x_nadsec_last_seen": "2026-04-28T19:48:24.910Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-28T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=BR; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--bea05a90-e534-42c4-b29d-6560ef2b91a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.200.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T20:05:02.000Z",
      "valid_until": "2026-05-30T20:05:01.000Z",
      "x_nadsec_event_count": 16,
      "x_nadsec_first_seen": "2026-04-28T19:43:25.099Z",
      "x_nadsec_last_seen": "2026-04-30T17:41:19.873Z",
      "x_nadsec_ports": [
        "1723",
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "pptpd",
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-28T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--cfd2ac42-98e2-4ffd-ad63-47c48fd33713",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T20:05:02.000Z",
      "valid_until": "2026-05-30T20:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-28T19:49:05.499Z",
      "x_nadsec_last_seen": "2026-04-28T19:49:06.935Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-28T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=EG; asn=8452; asn_org=TE Data; user(top)=a*******s; pass(top)=a********@",
      "id": "indicator--f29f3d52-11fc-4e8c-b7df-3d4121e39309",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.43.7.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T20:05:02.000Z",
      "valid_until": "2026-05-30T20:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T19:08:15.028Z",
      "x_nadsec_last_seen": "2026-04-28T19:08:15.028Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-04-28T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--af73614d-0b53-4726-bc0e-a48da1b6530b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.212.122.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T21:05:02.000Z",
      "valid_until": "2026-05-30T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T20:10:19.347Z",
      "x_nadsec_last_seen": "2026-04-28T20:10:19.347Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-04-28T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--69639878-2584-4318-87d6-fc1d844f3b3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '121.29.84.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T21:05:02.000Z",
      "valid_until": "2026-05-30T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T20:10:27.651Z",
      "x_nadsec_last_seen": "2026-04-28T20:10:27.651Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-04-28T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=LU; asn=214472; asn_org=Offshore LC",
      "id": "indicator--df479334-1b4b-4bbb-be8a-1ede47aba674",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T21:05:02.000Z",
      "valid_until": "2026-05-30T21:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-28T20:45:36.585Z",
      "x_nadsec_last_seen": "2026-04-30T19:03:52.118Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "LU"
      ],
      "x_nadsec_asns": [
        "214472"
      ],
      "x_nadsec_orgs": [
        "Offshore LC"
      ]
    },
    {
      "created": "2026-04-28T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--7f1a64dc-32fd-4905-aab8-df4720cd88d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T21:05:02.000Z",
      "valid_until": "2026-05-30T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T20:57:21.504Z",
      "x_nadsec_last_seen": "2026-04-28T20:57:21.504Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-28T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--cee46674-93de-4e37-a40e-a5f10db70101",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T21:05:02.000Z",
      "valid_until": "2026-05-30T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T20:56:47.039Z",
      "x_nadsec_last_seen": "2026-04-28T20:56:47.039Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-28T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--9b50d258-edf8-4ee6-bac0-8d0d895fa033",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T21:05:02.000Z",
      "valid_until": "2026-05-30T21:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-28T20:56:47.290Z",
      "x_nadsec_last_seen": "2026-04-29T14:59:35.057Z",
      "x_nadsec_ports": [
        "3306",
        "1433"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-28T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--17645fd7-d619-46f4-bfe9-bf67c42008df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T21:05:02.000Z",
      "valid_until": "2026-05-30T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T20:57:31.757Z",
      "x_nadsec_last_seen": "2026-04-28T20:57:31.757Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-28T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--cc32bb7f-a02f-47ff-8a99-805e3d657f5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T21:05:02.000Z",
      "valid_until": "2026-05-30T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T20:56:31.487Z",
      "x_nadsec_last_seen": "2026-04-28T20:56:31.487Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-28T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--1406f9b1-5c62-40f3-997e-a70ca6e808f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T21:05:02.000Z",
      "valid_until": "2026-05-30T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T20:20:13.411Z",
      "x_nadsec_last_seen": "2026-04-28T20:20:13.411Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-28T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--cbb8d1b4-fc9d-429e-922f-3c7f19009eb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '58.212.237.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T21:05:02.000Z",
      "valid_until": "2026-05-30T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T20:10:08.824Z",
      "x_nadsec_last_seen": "2026-04-28T20:10:08.824Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-28T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=40065; asn_org=CNSERVERS LLC",
      "id": "indicator--40536802-1ce3-45e2-a573-e8c1bff95c44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '162.253.66.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T23:05:03.000Z",
      "valid_until": "2026-05-30T23:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-28T22:39:19.696Z",
      "x_nadsec_last_seen": "2026-04-28T22:39:20.439Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "40065"
      ],
      "x_nadsec_orgs": [
        "CNSERVERS LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-28T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=47; services=smbd; ports=445; cc=BR; asn=18881; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--46d55dda-6fcd-4e60-a31c-ccf6405fe81f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '179.184.57.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T23:05:03.000Z",
      "valid_until": "2026-05-30T23:05:01.000Z",
      "x_nadsec_event_count": 47,
      "x_nadsec_first_seen": "2026-04-28T22:57:18.448Z",
      "x_nadsec_last_seen": "2026-04-28T23:00:49.807Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "18881"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-04-28T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6b5c1e40-25d2-459e-ad3d-efdc94a446c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T23:05:03.000Z",
      "valid_until": "2026-05-30T23:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-28T22:30:13.455Z",
      "x_nadsec_last_seen": "2026-04-28T22:30:13.455Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-28T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--96b96327-5f6a-4a0b-80e8-b32bb0877c49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.103.157.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T23:05:03.000Z",
      "valid_until": "2026-05-30T23:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-28T23:01:13.089Z",
      "x_nadsec_last_seen": "2026-04-28T23:01:39.892Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ]
    },
    {
      "created": "2026-04-29T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--45611d7d-4cdb-4c7e-b947-f532a81c2b42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '114.219.170.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T00:05:05.000Z",
      "valid_until": "2026-05-31T00:05:03.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-04-28T23:41:26.206Z",
      "x_nadsec_last_seen": "2026-04-28T23:43:41.735Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "*"
      ]
    },
    {
      "created": "2026-04-29T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--b7ef9779-df35-42b8-8ec2-e72c3179efae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '101.108.66.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T02:05:02.000Z",
      "valid_until": "2026-05-31T02:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-29T01:58:04.865Z",
      "x_nadsec_last_seen": "2026-04-29T01:58:04.931Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-04-29T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45916; asn_org=Gujarat Telelink Pvt Ltd",
      "id": "indicator--d05ebab5-9fd2-491d-b5aa-3b9a8b8beb2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.251.58.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T02:05:02.000Z",
      "valid_until": "2026-05-31T02:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-29T01:35:44.825Z",
      "x_nadsec_last_seen": "2026-04-29T01:37:49.620Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45916"
      ],
      "x_nadsec_orgs": [
        "Gujarat Telelink Pvt Ltd"
      ]
    },
    {
      "created": "2026-04-29T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=mongod; ports=27017; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a0c9ed19-bc7d-4147-b287-4393c36f407f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.244.128.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T02:05:02.000Z",
      "valid_until": "2026-05-31T02:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-29T01:58:49.283Z",
      "x_nadsec_last_seen": "2026-04-29T02:02:21.382Z",
      "x_nadsec_ports": [
        "42",
        "81",
        "135",
        "445",
        "1723",
        "3306",
        "27017",
        "43519"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-29T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CA; asn=16276; asn_org=OVH SAS; user(top)=c**n",
      "id": "indicator--b2da9ecc-3857-4596-ab5f-f8d42123f43d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '15.235.104.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T02:05:02.000Z",
      "valid_until": "2026-05-31T02:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T01:21:46.028Z",
      "x_nadsec_last_seen": "2026-04-29T01:21:46.028Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ],
      "x_nadsec_usernames_attempted": [
        "c**n"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-29T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--10dfaa3f-7943-4411-89f0-49f8b1cf56cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T02:05:02.000Z",
      "valid_until": "2026-05-31T02:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T01:45:27.338Z",
      "x_nadsec_last_seen": "2026-04-29T01:45:27.338Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-04-29T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MX; asn=8151; asn_org=UNINET; user(top)=**",
      "id": "indicator--1608250f-5fa7-4acb-83d0-b57d57461373",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '201.152.21.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T02:05:02.000Z",
      "valid_until": "2026-05-31T02:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T01:42:49.541Z",
      "x_nadsec_last_seen": "2026-04-29T01:42:49.541Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-29T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--8a0c908f-42ac-4f17-875d-9a4c099080da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.81.232.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T02:05:02.000Z",
      "valid_until": "2026-05-31T02:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-29T01:51:32.193Z",
      "x_nadsec_last_seen": "2026-04-29T01:53:37.735Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-29T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--d3dfb7e1-b68a-4436-acb1-36d3b45cf3ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.126.100.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T02:05:02.000Z",
      "valid_until": "2026-05-31T02:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-29T01:29:03.192Z",
      "x_nadsec_last_seen": "2026-04-29T01:36:56.269Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-29T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=8732; asn_org=JSC Comcor",
      "id": "indicator--f178f635-cf51-4cd8-b374-9d5161b7f754",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.79.7.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T02:05:02.000Z",
      "valid_until": "2026-05-31T02:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-29T01:51:42.035Z",
      "x_nadsec_last_seen": "2026-04-29T01:59:46.181Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8732"
      ],
      "x_nadsec_orgs": [
        "JSC Comcor"
      ]
    },
    {
      "created": "2026-04-29T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=24088; asn_org=Hanoi Telecom Joint Stock Company - HCMC Branch",
      "id": "indicator--8aef4a22-e2cd-4eb0-b872-f2a5d225e700",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.130.211.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T03:05:02.000Z",
      "valid_until": "2026-05-31T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-29T02:06:37.163Z",
      "x_nadsec_last_seen": "2026-04-29T02:08:41.608Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "24088"
      ],
      "x_nadsec_orgs": [
        "Hanoi Telecom Joint Stock Company - HCMC Branch"
      ]
    },
    {
      "created": "2026-04-29T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--3ea12254-4d23-496d-b996-6097a640b186",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.69.68.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T03:05:02.000Z",
      "valid_until": "2026-05-31T03:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-29T02:25:03.342Z",
      "x_nadsec_last_seen": "2026-04-29T02:27:08.728Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-04-29T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2462; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--f8d2d010-ba73-4707-a688-e7bf54c76223",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.161.92.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T03:05:02.000Z",
      "valid_until": "2026-05-31T03:05:01.000Z",
      "x_nadsec_event_count": 2462,
      "x_nadsec_first_seen": "2026-04-29T02:37:54.846Z",
      "x_nadsec_last_seen": "2026-04-29T03:00:11.396Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-29T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--b24fcce2-e108-492c-a99a-20f26f21d641",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.234.217.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T03:05:02.000Z",
      "valid_until": "2026-05-31T03:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-29T02:24:11.600Z",
      "x_nadsec_last_seen": "2026-04-29T02:24:41.600Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-29T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--1861f74f-9487-46e3-b18d-99e2440cb955",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T03:05:02.000Z",
      "valid_until": "2026-05-31T03:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-29T02:25:57.317Z",
      "x_nadsec_last_seen": "2026-04-29T02:26:27.324Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-04-29T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45903; asn_org=CMC Telecom Infrastructure Company",
      "id": "indicator--e457c133-d354-4aba-9e29-b408fc6f390b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '203.205.28.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T03:05:02.000Z",
      "valid_until": "2026-05-31T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T02:25:03.020Z",
      "x_nadsec_last_seen": "2026-04-29T02:25:03.020Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45903"
      ],
      "x_nadsec_orgs": [
        "CMC Telecom Infrastructure Company"
      ]
    },
    {
      "created": "2026-04-29T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=150923; asn_org=PT Sistem Interkoneksi Data",
      "id": "indicator--9ffab5a6-6bb5-48bb-b714-178752fed525",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.97.224.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T04:05:13.000Z",
      "valid_until": "2026-05-31T04:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-29T03:21:38.603Z",
      "x_nadsec_last_seen": "2026-04-29T03:28:19.135Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "150923"
      ],
      "x_nadsec_orgs": [
        "PT Sistem Interkoneksi Data"
      ]
    },
    {
      "created": "2026-04-29T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=SC; asn=401739; asn_org=RedLuff, LLC; user(top)=**",
      "id": "indicator--a4d039d1-9961-42ef-8f96-21eabec76675",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '156.247.41.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T04:05:13.000Z",
      "valid_until": "2026-05-31T04:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-29T03:48:54.476Z",
      "x_nadsec_last_seen": "2026-04-29T03:48:55.749Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "401739"
      ],
      "x_nadsec_orgs": [
        "RedLuff, LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-29T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=KZ; asn=35104; asn_org=Jusan Mobile JSC",
      "id": "indicator--415b3b91-e2eb-470f-bab4-8e774a43a7ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.228.64.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T04:05:13.000Z",
      "valid_until": "2026-05-31T04:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-29T03:46:36.736Z",
      "x_nadsec_last_seen": "2026-04-29T03:46:36.848Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "35104"
      ],
      "x_nadsec_orgs": [
        "Jusan Mobile JSC"
      ]
    },
    {
      "created": "2026-04-29T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--9b526510-6f9d-4768-8dbf-8b21d50c87ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T05:05:02.000Z",
      "valid_until": "2026-05-31T05:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T04:36:15.457Z",
      "x_nadsec_last_seen": "2026-04-29T04:36:15.457Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-29T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--8951b63d-09fc-4566-aec1-3e0f85978d4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T05:05:02.000Z",
      "valid_until": "2026-05-31T05:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T04:36:03.601Z",
      "x_nadsec_last_seen": "2026-04-29T04:36:03.601Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-29T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--5dbd0747-b985-4dcf-b5f3-62b2e92e2204",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T05:05:02.000Z",
      "valid_until": "2026-05-31T05:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-29T04:35:26.171Z",
      "x_nadsec_last_seen": "2026-04-29T04:35:45.581Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-29T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--79475ebc-ae55-4861-9935-dcc4c74de0bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T05:05:02.000Z",
      "valid_until": "2026-05-31T05:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T04:35:43.846Z",
      "x_nadsec_last_seen": "2026-04-29T04:35:43.846Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-04-29T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--8ba4c567-527e-44b2-83f7-69293990a5c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '110.226.127.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T05:05:02.000Z",
      "valid_until": "2026-05-31T05:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-29T05:04:15.822Z",
      "x_nadsec_last_seen": "2026-04-29T05:06:20.744Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-04-29T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d0b5fd85-2e89-4ced-bfe6-a9c06d02eaf8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T05:05:02.000Z",
      "valid_until": "2026-05-31T05:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T04:39:39.172Z",
      "x_nadsec_last_seen": "2026-04-29T04:39:39.172Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-29T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--e43f6578-e8a1-4dfc-8398-06daffa8e90c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.83.223.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T05:05:02.000Z",
      "valid_until": "2026-05-31T05:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-29T04:33:33.580Z",
      "x_nadsec_last_seen": "2026-04-29T04:35:42.798Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-29T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--af223f7a-a037-42dc-b363-3507ae375b12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T05:05:02.000Z",
      "valid_until": "2026-05-31T05:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T04:48:11.209Z",
      "x_nadsec_last_seen": "2026-04-29T04:48:11.209Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-29T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--93db0f3c-3dd2-442f-8df7-c6744dad8585",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T05:05:02.000Z",
      "valid_until": "2026-05-31T05:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T04:48:10.574Z",
      "x_nadsec_last_seen": "2026-04-29T04:48:10.574Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-29T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=21299; asn_org=Kar-Tel LLC",
      "id": "indicator--ef91f1a8-a2f4-46fa-8b35-2d3e8351de2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '92.55.172.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T05:05:02.000Z",
      "valid_until": "2026-05-31T05:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-29T04:40:33.412Z",
      "x_nadsec_last_seen": "2026-04-29T04:42:40.463Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "21299"
      ],
      "x_nadsec_orgs": [
        "Kar-Tel LLC"
      ]
    },
    {
      "created": "2026-04-29T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=136342; asn_org=Winux Communications Pvt. Ltd.",
      "id": "indicator--e7b8bdbf-6a26-407f-9f60-ed2a23dc3e45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.127.186.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T06:05:11.000Z",
      "valid_until": "2026-05-31T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-29T05:39:04.010Z",
      "x_nadsec_last_seen": "2026-04-29T05:41:09.164Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "136342"
      ],
      "x_nadsec_orgs": [
        "Winux Communications Pvt. Ltd."
      ]
    },
    {
      "created": "2026-04-29T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=KZ; asn=41798; asn_org=JSC Transtelecom",
      "id": "indicator--e4dc16c6-be74-4645-9129-c3f9fbf12fa8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.22.169.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T06:05:11.000Z",
      "valid_until": "2026-05-31T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-29T05:06:26.704Z",
      "x_nadsec_last_seen": "2026-04-29T05:13:40.588Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "41798"
      ],
      "x_nadsec_orgs": [
        "JSC Transtelecom"
      ]
    },
    {
      "created": "2026-04-29T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--8cba0e21-b833-4b2a-8cc2-6d144652e2a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T06:05:11.000Z",
      "valid_until": "2026-05-31T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T05:50:51.629Z",
      "x_nadsec_last_seen": "2026-04-29T05:50:51.629Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-29T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--e94809af-6926-49ea-8e07-db5103cf92a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.233.211.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T06:05:11.000Z",
      "valid_until": "2026-05-31T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-29T05:36:04.336Z",
      "x_nadsec_last_seen": "2026-04-29T05:38:09.374Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-29T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--0ff33c89-aa73-4e4e-8436-b6e2c8f34c3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.251.42.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T06:05:11.000Z",
      "valid_until": "2026-05-31T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T06:01:07.760Z",
      "x_nadsec_last_seen": "2026-04-29T06:01:07.760Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-29T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--f5425fa3-d298-4163-b9d7-e5a86f6df653",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T06:05:11.000Z",
      "valid_until": "2026-05-31T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T05:33:08.587Z",
      "x_nadsec_last_seen": "2026-04-29T05:33:08.587Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-29T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--257b22d0-dadb-4553-81ea-1fed63bdf5a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.53.212.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T07:05:10.000Z",
      "valid_until": "2026-05-31T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T06:46:31.920Z",
      "x_nadsec_last_seen": "2026-04-29T06:46:31.920Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-29T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--04468460-2655-4801-8582-1790a6c50f74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.79.123.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T07:05:10.000Z",
      "valid_until": "2026-05-31T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-29T06:46:42.140Z",
      "x_nadsec_last_seen": "2026-04-29T06:46:57.149Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-04-29T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IR; asn=211670; asn_org=Fasa University",
      "id": "indicator--f58304f4-31ae-4285-95ac-fa6b08399cf1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.190.211.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T07:05:10.000Z",
      "valid_until": "2026-05-31T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-29T06:21:45.823Z",
      "x_nadsec_last_seen": "2026-04-29T06:21:53.415Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IR"
      ],
      "x_nadsec_asns": [
        "211670"
      ],
      "x_nadsec_orgs": [
        "Fasa University"
      ]
    },
    {
      "created": "2026-04-29T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=47524; asn_org=Turksat Uydu Haberlesme Kablo TV ve Isletme A.S.",
      "id": "indicator--3e64f2ab-8ef5-4c12-b2da-74bbb04016a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.233.8.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T08:05:10.000Z",
      "valid_until": "2026-05-31T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-29T07:31:26.279Z",
      "x_nadsec_last_seen": "2026-04-29T07:33:33.481Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "47524"
      ],
      "x_nadsec_orgs": [
        "Turksat Uydu Haberlesme Kablo TV ve Isletme A.S."
      ]
    },
    {
      "created": "2026-04-29T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--02f6bcbf-349f-4417-9f44-555fc7ed6bbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T08:05:10.000Z",
      "valid_until": "2026-05-31T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T07:38:36.390Z",
      "x_nadsec_last_seen": "2026-04-29T07:38:36.390Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-29T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--9d17a3d4-2de0-4b28-b676-e99cc967e28f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T08:05:10.000Z",
      "valid_until": "2026-05-31T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-29T07:37:47.988Z",
      "x_nadsec_last_seen": "2026-04-29T07:38:56.889Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-04-29T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--d132d84e-86ec-43bc-ac1b-c662d76c68fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T08:05:10.000Z",
      "valid_until": "2026-05-31T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-29T07:38:12.809Z",
      "x_nadsec_last_seen": "2026-04-29T07:38:17.812Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-04-29T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--40ecd474-46a4-4cfc-bc44-5e833d9a8923",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T08:05:10.000Z",
      "valid_until": "2026-05-31T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-29T07:37:56.733Z",
      "x_nadsec_last_seen": "2026-04-29T07:38:28.155Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-04-29T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--ea078ff2-1e92-4046-a8f2-84c7b7a2a552",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T08:05:10.000Z",
      "valid_until": "2026-05-31T08:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-29T07:37:54.651Z",
      "x_nadsec_last_seen": "2026-04-29T07:38:46.362Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-04-29T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--cf645e7e-645d-4cbd-bbf5-ff714ced38d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T08:05:10.000Z",
      "valid_until": "2026-05-31T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-29T07:33:46.515Z",
      "x_nadsec_last_seen": "2026-04-29T07:33:48.734Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-29T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--f71ad4ff-6896-48dd-ae1d-d663f2d2f853",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.175.57.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T09:05:02.000Z",
      "valid_until": "2026-05-31T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-29T08:13:16.568Z",
      "x_nadsec_last_seen": "2026-04-29T08:15:21.365Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-29T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SC; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--220e0a9b-ca89-40f0-bc5f-137c0db39845",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.197.56.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T09:05:02.000Z",
      "valid_until": "2026-05-31T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T08:29:58.886Z",
      "x_nadsec_last_seen": "2026-04-29T08:29:58.886Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-29T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=4796; asn_org=Institute of Technology Bandung",
      "id": "indicator--5c21e092-2290-4e94-b4e0-e60478dc792b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '167.205.0.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T09:05:02.000Z",
      "valid_until": "2026-05-31T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T08:13:00.562Z",
      "x_nadsec_last_seen": "2026-04-29T08:13:00.562Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "4796"
      ],
      "x_nadsec_orgs": [
        "Institute of Technology Bandung"
      ]
    },
    {
      "created": "2026-04-29T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f60c76ad-acb3-48b2-832b-24c06387ebe7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '167.99.142.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T09:05:02.000Z",
      "valid_until": "2026-05-31T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T08:25:22.880Z",
      "x_nadsec_last_seen": "2026-04-29T08:25:22.880Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-29T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=httpd; ports=81; cc=AU; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--ba83970a-7adf-44f2-a223-47c06a027fb1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '170.64.176.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T09:05:02.000Z",
      "valid_until": "2026-05-31T09:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-04-29T08:28:20.415Z",
      "x_nadsec_last_seen": "2026-04-29T08:28:39.927Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-29T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--66d0d8e9-548a-4de8-973e-7c217b885db7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.163.37.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T09:05:02.000Z",
      "valid_until": "2026-05-31T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-29T08:21:28.431Z",
      "x_nadsec_last_seen": "2026-04-29T08:21:38.574Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-29T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e27be004-fe95-4284-9a4d-ede51203f981",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T09:05:02.000Z",
      "valid_until": "2026-05-31T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-29T08:35:19.062Z",
      "x_nadsec_last_seen": "2026-04-29T08:35:29.223Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-29T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=19318; asn_org=Interserver, Inc; user(top)=**; pass(top)=1****6",
      "id": "indicator--42504350-c82c-4644-8974-4b8636df5248",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '216.158.233.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T09:05:02.000Z",
      "valid_until": "2026-05-31T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-29T08:12:54.397Z",
      "x_nadsec_last_seen": "2026-04-29T15:20:14.251Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "19318"
      ],
      "x_nadsec_orgs": [
        "Interserver, Inc"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6"
      ]
    },
    {
      "created": "2026-04-29T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=NL; asn=62068; asn_org=SpectraIP B.V.",
      "id": "indicator--d93e7555-653f-431d-833e-7c223021417c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.182.209.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T09:05:02.000Z",
      "valid_until": "2026-05-31T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T08:59:41.951Z",
      "x_nadsec_last_seen": "2026-04-29T08:59:41.951Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "62068"
      ],
      "x_nadsec_orgs": [
        "SpectraIP B.V."
      ]
    },
    {
      "created": "2026-04-29T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ZA; asn=16637; asn_org=MTN Business Solutions",
      "id": "indicator--832aa1dc-a33c-460e-846e-e8b1bf22db66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.8.6.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T09:05:02.000Z",
      "valid_until": "2026-05-31T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-29T09:04:29.093Z",
      "x_nadsec_last_seen": "2026-04-29T09:06:42.258Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "16637"
      ],
      "x_nadsec_orgs": [
        "MTN Business Solutions"
      ]
    },
    {
      "created": "2026-04-29T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--816150d4-1b3e-4eed-bb66-f366961d86be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T09:05:02.000Z",
      "valid_until": "2026-05-31T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T08:53:21.532Z",
      "x_nadsec_last_seen": "2026-04-29T08:53:21.532Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-04-29T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--0c5e6938-c67a-40fc-aa90-d3ab05ef345f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.55.255.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T10:05:10.000Z",
      "valid_until": "2026-05-31T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-29T09:38:10.293Z",
      "x_nadsec_last_seen": "2026-04-29T09:40:16.454Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-04-29T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--f4870e66-a661-40e6-b706-9ee6eb2d3c0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.144.170.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T10:05:10.000Z",
      "valid_until": "2026-05-31T10:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-29T09:48:24.560Z",
      "x_nadsec_last_seen": "2026-04-29T09:48:30.150Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-04-29T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--8c2b23c8-104a-4274-a28b-98e23deff66d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '117.239.7.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T10:05:10.000Z",
      "valid_until": "2026-05-31T10:05:09.000Z",
      "x_nadsec_event_count": 3128,
      "x_nadsec_first_seen": "2026-04-29T09:59:28.048Z",
      "x_nadsec_last_seen": "2026-04-29T11:26:01.051Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-04-29T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--6c0cc3ae-61a2-4332-8ba7-1818ebfd6fdc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '156.196.58.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T10:05:10.000Z",
      "valid_until": "2026-05-31T10:05:09.000Z",
      "x_nadsec_event_count": 45,
      "x_nadsec_first_seen": "2026-04-29T09:59:42.914Z",
      "x_nadsec_last_seen": "2026-04-29T10:02:25.800Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-29T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--69119d6e-b02d-41db-b31c-3498231dec56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '164.92.179.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T10:05:10.000Z",
      "valid_until": "2026-05-31T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T09:15:33.913Z",
      "x_nadsec_last_seen": "2026-04-29T09:15:33.913Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-29T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--141db625-9ec8-4801-bf1f-259b67c12fbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '167.172.185.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T10:05:10.000Z",
      "valid_until": "2026-05-31T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-29T09:15:21.286Z",
      "x_nadsec_last_seen": "2026-04-29T09:15:32.609Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-29T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17451; asn_org=BIZNET NETWORKS",
      "id": "indicator--839c10bb-8d2a-4333-a305-617f0f31a282",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.253.138.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T10:05:10.000Z",
      "valid_until": "2026-05-31T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-29T09:11:29.927Z",
      "x_nadsec_last_seen": "2026-04-29T09:13:35.270Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17451"
      ],
      "x_nadsec_orgs": [
        "BIZNET NETWORKS"
      ]
    },
    {
      "created": "2026-04-29T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--6686bd56-1670-4571-92e4-e82f5bc00731",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '183.82.108.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T10:05:10.000Z",
      "valid_until": "2026-05-31T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T09:28:11.996Z",
      "x_nadsec_last_seen": "2026-04-29T09:28:11.996Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-04-29T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--819072aa-8eda-4c51-ab66-517e9ae5a2c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '187.224.144.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T10:05:10.000Z",
      "valid_until": "2026-05-31T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-29T09:13:45.073Z",
      "x_nadsec_last_seen": "2026-04-29T09:13:45.118Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-04-29T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--2246ce10-a794-49af-9127-efe7e8bab7c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.65.12.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T10:05:10.000Z",
      "valid_until": "2026-05-31T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T09:48:24.223Z",
      "x_nadsec_last_seen": "2026-04-29T09:48:24.223Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-04-29T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=RU; asn=3267; asn_org=NIKS",
      "id": "indicator--49a506b1-9b4a-4d3e-bf58-309f7605619d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.142.124.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T10:05:10.000Z",
      "valid_until": "2026-05-31T10:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-29T09:29:03.941Z",
      "x_nadsec_last_seen": "2026-04-29T09:58:49.079Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "3267"
      ],
      "x_nadsec_orgs": [
        "NIKS"
      ]
    },
    {
      "created": "2026-04-29T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mysqld; ports=3306; cc=SC; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--ad1af1cd-644a-44c8-a053-e6098af6b5bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T11:05:02.000Z",
      "valid_until": "2026-05-31T11:05:01.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-04-29T10:45:20.584Z",
      "x_nadsec_last_seen": "2026-04-29T10:53:53.917Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-04-29T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--05865cd5-95ab-4df6-a8c6-5f3a21f23e29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.97.5.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T11:05:02.000Z",
      "valid_until": "2026-05-31T11:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-29T10:07:02.420Z",
      "x_nadsec_last_seen": "2026-04-29T10:07:24.263Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-29T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--a80d64a8-7d82-40fc-8594-46ccbc108ba4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.34.178.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T11:05:02.000Z",
      "valid_until": "2026-05-31T11:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-29T11:00:17.775Z",
      "x_nadsec_last_seen": "2026-04-29T11:00:18.285Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-04-29T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CA; asn=215540; asn_org=Global Connectivity Solutions Llp",
      "id": "indicator--4a27b9d3-12c2-4007-8cae-38dfe7e272cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.148.103.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T11:05:02.000Z",
      "valid_until": "2026-05-31T11:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-22T02:49:45.121Z",
      "x_nadsec_last_seen": "2026-04-29T16:54:14.199Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "215540"
      ],
      "x_nadsec_orgs": [
        "Global Connectivity Solutions Llp"
      ]
    },
    {
      "created": "2026-04-29T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mqttd; ports=1883; cc=GB; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--c8a96dd7-8420-499a-b05a-84ee9d180762",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.101.1.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T11:05:02.000Z",
      "valid_until": "2026-05-31T11:05:01.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-04-29T11:02:35.286Z",
      "x_nadsec_last_seen": "2026-04-29T11:02:40.966Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-29T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--63563ca8-48da-4d26-ac31-42185e8d58bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T11:05:02.000Z",
      "valid_until": "2026-05-31T11:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T10:31:00.489Z",
      "x_nadsec_last_seen": "2026-04-29T10:31:00.489Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-29T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--8e50dff4-0c71-4e01-ae12-c865e118aab7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '93.120.243.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T11:05:02.000Z",
      "valid_until": "2026-05-31T11:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-29T10:25:14.381Z",
      "x_nadsec_last_seen": "2026-04-29T10:26:34.797Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-29T12:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--9fb5967b-ccd8-413e-99b1-9f92e9f33420",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T12:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.212.200.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T12:05:04.000Z",
      "valid_until": "2026-05-31T12:05:02.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-29T11:34:38.601Z",
      "x_nadsec_last_seen": "2026-04-29T11:34:38.951Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-29T12:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--46120c7d-e1aa-4331-a860-c0cce961d2a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T12:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.38.197.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T12:05:04.000Z",
      "valid_until": "2026-05-31T12:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T11:13:49.070Z",
      "x_nadsec_last_seen": "2026-04-29T11:13:49.070Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-29T12:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--a8c9321f-7eac-4fb8-9f97-fe3d52d04f6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T12:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T12:05:04.000Z",
      "valid_until": "2026-05-31T12:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T11:34:03.401Z",
      "x_nadsec_last_seen": "2026-04-29T11:34:03.401Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-29T12:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--23c92e9a-5653-42c9-894a-7f4c5333374b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T12:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T12:05:04.000Z",
      "valid_until": "2026-05-31T12:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T11:32:34.462Z",
      "x_nadsec_last_seen": "2026-04-29T11:32:34.462Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-29T13:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--e81148bc-e709-4290-b28c-faf011d829e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T13:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '180.194.165.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T13:05:01.000Z",
      "valid_until": "2026-05-31T13:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-29T12:22:07.306Z",
      "x_nadsec_last_seen": "2026-04-29T12:22:13.862Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-04-29T13:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--92e33d3e-1daf-4e56-9621-f4c5c5210d5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T13:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.139.175.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T13:05:01.000Z",
      "valid_until": "2026-05-31T13:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-29T12:13:10.774Z",
      "x_nadsec_last_seen": "2026-04-29T12:15:16.289Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-29T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--9908dcdd-2f01-4fd8-8d46-15db03100939",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.182.213.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T15:05:03.000Z",
      "valid_until": "2026-05-31T15:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-29T13:31:11.494Z",
      "x_nadsec_last_seen": "2026-04-29T14:17:13.915Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "445",
        "1433",
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-29T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--f88bef9a-32bf-483e-865b-3ab47ac2552e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.202.45.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T15:05:03.000Z",
      "valid_until": "2026-05-31T15:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-04-29T14:51:43.862Z",
      "x_nadsec_last_seen": "2026-04-29T15:20:33.305Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-04-29T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--6c95278a-9a3a-449e-8b44-dfcbe7d2ece6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T15:05:03.000Z",
      "valid_until": "2026-05-31T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T14:58:58.306Z",
      "x_nadsec_last_seen": "2026-04-29T14:58:58.306Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-29T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--42c4b1e6-fcb0-4fe6-b6ca-129b3c9f0e22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.40.208.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T15:05:03.000Z",
      "valid_until": "2026-05-31T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T14:50:10.808Z",
      "x_nadsec_last_seen": "2026-04-29T14:50:10.808Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-29T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--68c62d3a-5f5f-4480-9258-ee069450fa84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '201.147.171.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T15:05:03.000Z",
      "valid_until": "2026-05-31T15:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-01T22:34:16.389Z",
      "x_nadsec_last_seen": "2026-04-29T14:45:03.128Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-04-29T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=30; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--518f3fd7-511b-436b-abb6-24e4af8bff83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.77.48.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T15:05:03.000Z",
      "valid_until": "2026-05-31T15:05:01.000Z",
      "x_nadsec_event_count": 30,
      "x_nadsec_first_seen": "2026-04-29T14:55:09.208Z",
      "x_nadsec_last_seen": "2026-04-29T14:55:45.949Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "***",
        "",
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-29T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--8c870a1a-2e36-4db8-ab0e-99699a73011f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.187.55.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T15:05:03.000Z",
      "valid_until": "2026-05-31T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T14:55:06.989Z",
      "x_nadsec_last_seen": "2026-04-29T14:55:06.989Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-29T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a75f4c8f-f4d4-4c31-b5e4-f225ca8dcd0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '9.234.10.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T15:05:03.000Z",
      "valid_until": "2026-05-31T15:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-29T14:43:24.206Z",
      "x_nadsec_last_seen": "2026-04-29T14:43:34.559Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-29T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a7e2f7ff-f7e9-4a8c-bc91-83392a40804c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.237.123.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T16:05:03.000Z",
      "valid_until": "2026-05-31T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T15:30:11.196Z",
      "x_nadsec_last_seen": "2026-04-29T15:30:11.196Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-29T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--619cf14a-368c-45fa-9edc-73a49bac7bad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.174.204.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T16:05:03.000Z",
      "valid_until": "2026-05-31T16:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-29T15:06:57.448Z",
      "x_nadsec_last_seen": "2026-04-29T15:13:33.877Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-04-29T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--f2ec1bda-ad99-4911-ab8e-5f7c38216e0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T16:05:03.000Z",
      "valid_until": "2026-05-31T16:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-11T14:37:52.853Z",
      "x_nadsec_last_seen": "2026-04-29T15:26:03.018Z",
      "x_nadsec_ports": [
        "445",
        "135"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-29T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--1b87f097-e73d-45bc-aadc-7fbf42519d95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T17:05:02.000Z",
      "valid_until": "2026-05-31T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T16:57:58.738Z",
      "x_nadsec_last_seen": "2026-04-29T16:57:58.738Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-29T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--1aa2e89a-033d-4efe-80ce-0bc68f8772f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T17:05:02.000Z",
      "valid_until": "2026-05-31T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T16:31:41.166Z",
      "x_nadsec_last_seen": "2026-04-29T16:31:41.166Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-29T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--3e4b1674-b8af-4986-84b0-7564b360ece8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T17:05:02.000Z",
      "valid_until": "2026-05-31T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T16:48:06.739Z",
      "x_nadsec_last_seen": "2026-04-29T16:48:06.739Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-04-29T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--a520ede6-a3bc-447f-9c11-c0eff72cb550",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.91.4.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T20:05:13.000Z",
      "valid_until": "2026-05-31T20:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T19:15:43.915Z",
      "x_nadsec_last_seen": "2026-04-29T19:15:43.915Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-04-29T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--c3452a33-0631-4db4-8cb8-3cb914e94328",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.91.4.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T20:05:13.000Z",
      "valid_until": "2026-05-31T20:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-29T19:17:49.148Z",
      "x_nadsec_last_seen": "2026-04-29T19:20:09.318Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-04-29T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--a985f6ac-1db1-4e64-9bf1-d36caf2943a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.91.5.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T20:05:13.000Z",
      "valid_until": "2026-05-31T20:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T19:17:52.635Z",
      "x_nadsec_last_seen": "2026-04-29T19:17:52.635Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-04-29T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--ac3de06c-8570-4fb4-9db9-5c73ad9816ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T20:05:13.000Z",
      "valid_until": "2026-05-31T20:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T19:18:41.297Z",
      "x_nadsec_last_seen": "2026-04-29T19:18:41.297Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-29T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=7738; asn_org=V tal",
      "id": "indicator--6c566df7-fb20-45b2-892a-8ed74947cd90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '200.165.48.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T20:05:13.000Z",
      "valid_until": "2026-05-31T20:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-29T19:05:25.789Z",
      "x_nadsec_last_seen": "2026-04-29T19:07:32.622Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "7738"
      ],
      "x_nadsec_orgs": [
        "V tal"
      ]
    },
    {
      "created": "2026-04-29T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--4eb411dc-e8a0-46e3-9208-27abdc9244ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T21:05:02.000Z",
      "valid_until": "2026-05-31T21:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T20:14:23.928Z",
      "x_nadsec_last_seen": "2026-04-29T20:14:23.928Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-04-29T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--98dabc1c-6e50-44ce-a24e-cd34faa72b48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.59.63.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T21:05:02.000Z",
      "valid_until": "2026-05-31T21:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-29T20:18:43.531Z",
      "x_nadsec_last_seen": "2026-04-29T20:20:50.054Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-29T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--20816c33-60be-4710-9d92-2f24f5fcbe0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T21:05:02.000Z",
      "valid_until": "2026-05-31T21:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T20:23:29.298Z",
      "x_nadsec_last_seen": "2026-04-29T20:23:29.298Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-29T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d72775f4-f055-42ea-bacf-885696d18b1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T21:05:02.000Z",
      "valid_until": "2026-05-31T21:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T20:11:17.271Z",
      "x_nadsec_last_seen": "2026-04-29T20:11:17.271Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-29T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ba125fac-97a9-4a45-8d52-79a80e3ddf6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.235.205.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T21:05:02.000Z",
      "valid_until": "2026-05-31T21:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T21:01:03.340Z",
      "x_nadsec_last_seen": "2026-04-29T21:01:03.340Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-29T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=39812; asn_org=Closed Joint Stock Company Radiotelephone",
      "id": "indicator--6c0b63e6-29b8-488e-8b40-a4178c752998",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '130.255.37.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T22:05:02.000Z",
      "valid_until": "2026-05-31T22:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-29T21:53:05.169Z",
      "x_nadsec_last_seen": "2026-04-29T21:55:11.976Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "39812"
      ],
      "x_nadsec_orgs": [
        "Closed Joint Stock Company Radiotelephone"
      ]
    },
    {
      "created": "2026-04-29T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--538cfc64-b57c-4f84-81fd-345cfec58619",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.10.98.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T22:05:02.000Z",
      "valid_until": "2026-05-31T22:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-29T21:28:17.690Z",
      "x_nadsec_last_seen": "2026-04-29T21:30:23.089Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-04-29T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=47; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--abffd7d5-e4bb-4d73-a831-486c6d077ad7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.207.251.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T22:05:02.000Z",
      "valid_until": "2026-05-31T22:05:00.000Z",
      "x_nadsec_event_count": 47,
      "x_nadsec_first_seen": "2026-04-29T21:35:37.058Z",
      "x_nadsec_last_seen": "2026-04-29T21:39:30.662Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-04-29T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--7bea7f73-7a20-4984-a820-3f7377458f38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T22:05:02.000Z",
      "valid_until": "2026-05-31T22:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T21:42:28.299Z",
      "x_nadsec_last_seen": "2026-04-29T21:42:28.299Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-29T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--2f0c4569-32dd-4e90-b293-4c695f41c38b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T22:05:02.000Z",
      "valid_until": "2026-05-31T22:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T21:09:37.677Z",
      "x_nadsec_last_seen": "2026-04-29T21:09:37.677Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-29T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--42c2d17c-7ec3-40c4-9e12-3e0ae4444178",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T22:05:02.000Z",
      "valid_until": "2026-05-31T22:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T21:09:48.026Z",
      "x_nadsec_last_seen": "2026-04-29T21:09:48.026Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-29T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=26; services=mqttd; ports=1883; cc=SC; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--fdbc00f7-7c1b-46ce-bdc0-fc0ec5fcc9ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T23:05:03.000Z",
      "valid_until": "2026-05-31T23:05:01.000Z",
      "x_nadsec_event_count": 26,
      "x_nadsec_first_seen": "2026-04-29T22:20:07.423Z",
      "x_nadsec_last_seen": "2026-04-29T22:54:41.506Z",
      "x_nadsec_ports": [
        "135",
        "81",
        "1433",
        "1883",
        "27017",
        "21",
        "445",
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "ftpd",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-04-29T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c770c341-09a7-4017-9a9b-9444e40c971d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.202.118.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T23:05:03.000Z",
      "valid_until": "2026-05-31T23:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-29T22:58:58.631Z",
      "x_nadsec_last_seen": "2026-04-29T22:59:08.802Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-29T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=DO; asn=6400; asn_org=Compania Dominicana de Telefonos S. A.",
      "id": "indicator--37a28b6e-4675-4008-a95c-39466229ac80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '200.88.193.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T23:05:03.000Z",
      "valid_until": "2026-05-31T23:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-29T22:46:25.690Z",
      "x_nadsec_last_seen": "2026-04-29T22:53:07.609Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DO"
      ],
      "x_nadsec_asns": [
        "6400"
      ],
      "x_nadsec_orgs": [
        "Compania Dominicana de Telefonos S. A."
      ]
    },
    {
      "created": "2026-04-29T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--39edf742-b8f4-4c10-b1a2-9bff620d0add",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.235.100.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T23:05:03.000Z",
      "valid_until": "2026-05-31T23:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-29T22:08:14.316Z",
      "x_nadsec_last_seen": "2026-04-29T22:08:15.165Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-30T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45543; asn_org=SaiGon Tourist cable Televition Company",
      "id": "indicator--4418aca1-4209-41f0-9e65-2dd6c4dcc412",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '112.197.129.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T00:05:03.000Z",
      "valid_until": "2026-06-01T00:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-29T23:24:24.881Z",
      "x_nadsec_last_seen": "2026-04-29T23:31:06.413Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45543"
      ],
      "x_nadsec_orgs": [
        "SaiGon Tourist cable Televition Company"
      ]
    },
    {
      "created": "2026-04-30T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=VN; asn=7552; asn_org=Viettel Group; user(top)=**",
      "id": "indicator--ad66ec34-5c5d-427b-877a-d54f9b1b089d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '117.3.63.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T00:05:03.000Z",
      "valid_until": "2026-06-01T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-29T23:07:09.524Z",
      "x_nadsec_last_seen": "2026-04-29T23:07:09.524Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-30T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=49718; asn_org=Nizhnevolzhskie Telecommunication Networks Real LLC",
      "id": "indicator--1267dd40-365c-4fc6-875b-58b17f06c3ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '213.108.175.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T00:05:03.000Z",
      "valid_until": "2026-06-01T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-29T23:43:34.544Z",
      "x_nadsec_last_seen": "2026-04-29T23:45:41.284Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "49718"
      ],
      "x_nadsec_orgs": [
        "Nizhnevolzhskie Telecommunication Networks Real LLC"
      ]
    },
    {
      "created": "2026-04-30T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--16b480fc-fd45-4c24-90a6-1d5b2bad5514",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '39.144.60.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T00:05:03.000Z",
      "valid_until": "2026-06-01T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-29T23:10:28.547Z",
      "x_nadsec_last_seen": "2026-04-29T23:12:33.667Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-04-30T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--d368987a-383b-439e-b617-0f022486106d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '39.144.60.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T00:05:03.000Z",
      "valid_until": "2026-06-01T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-29T23:12:33.429Z",
      "x_nadsec_last_seen": "2026-04-29T23:12:36.965Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-04-30T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f912e2ca-6a4a-4899-b6e7-515407d3b1e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.67.177.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T00:05:03.000Z",
      "valid_until": "2026-06-01T00:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-29T23:30:27.515Z",
      "x_nadsec_last_seen": "2026-04-29T23:30:28.238Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-30T01:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MY; asn=133014; asn_org=Universiti Teknologi Malaysia",
      "id": "indicator--99b68df9-5b59-406a-8c3e-4a59b0f9fe10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T01:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '161.139.102.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T01:05:12.000Z",
      "valid_until": "2026-06-01T01:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-30T00:51:54.357Z",
      "x_nadsec_last_seen": "2026-04-30T00:54:02.048Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "133014"
      ],
      "x_nadsec_orgs": [
        "Universiti Teknologi Malaysia"
      ]
    },
    {
      "created": "2026-04-30T01:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PS; asn=12975; asn_org=Palestine Telecommunications Company (PALTEL)",
      "id": "indicator--0f940c29-ac98-4de9-b871-ffaab1ab68d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T01:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '213.6.33.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T01:05:12.000Z",
      "valid_until": "2026-06-01T01:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-30T00:25:08.271Z",
      "x_nadsec_last_seen": "2026-04-30T00:32:30.578Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PS"
      ],
      "x_nadsec_asns": [
        "12975"
      ],
      "x_nadsec_orgs": [
        "Palestine Telecommunications Company (PALTEL)"
      ]
    },
    {
      "created": "2026-04-30T01:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--afaf64b9-0ad2-4c07-84c6-69064a209001",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T01:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '223.197.161.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T01:05:12.000Z",
      "valid_until": "2026-06-01T01:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-30T00:20:08.068Z",
      "x_nadsec_last_seen": "2026-04-30T00:26:33.289Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-04-30T01:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--ccb67f42-1188-4769-98b0-bb7fc6ec6c33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T01:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '54.227.4.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T01:05:12.000Z",
      "valid_until": "2026-06-01T01:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T00:53:20.618Z",
      "x_nadsec_last_seen": "2026-04-30T00:56:03.246Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-30T01:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; user(top)=**",
      "id": "indicator--a8feb2a3-e797-449b-8002-bf63bd92885f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T01:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '60.26.3.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T01:05:12.000Z",
      "valid_until": "2026-06-01T01:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T00:11:35.438Z",
      "x_nadsec_last_seen": "2026-04-30T00:11:35.438Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-30T01:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--60e6dd63-225e-474f-9c8f-d6c574edd192",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T01:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T01:05:12.000Z",
      "valid_until": "2026-06-01T01:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-30T00:54:14.809Z",
      "x_nadsec_last_seen": "2026-04-30T00:54:16.544Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-04-30T02:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--a2fb824a-a19b-403b-990c-70dffe6f0675",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T02:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.218.160.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T02:05:07.000Z",
      "valid_until": "2026-06-01T02:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-30T01:06:36.729Z",
      "x_nadsec_last_seen": "2026-04-30T01:06:40.346Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-04-30T02:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--74f29da2-b489-41e4-9c4e-4382daa34228",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T02:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.242.40.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T02:05:07.000Z",
      "valid_until": "2026-06-01T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-30T01:44:56.535Z",
      "x_nadsec_last_seen": "2026-04-30T01:47:02.885Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-04-30T02:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--3501f286-131b-459f-87df-d6e712b432f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T02:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.2.74.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T02:05:07.000Z",
      "valid_until": "2026-06-01T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T02:01:49.275Z",
      "x_nadsec_last_seen": "2026-04-30T02:01:49.275Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-04-30T02:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8ea0bc3a-8c0e-4646-8b25-b4b4a914ee49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T02:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.168.7.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T02:05:07.000Z",
      "valid_until": "2026-06-01T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T01:13:17.556Z",
      "x_nadsec_last_seen": "2026-04-30T01:13:17.556Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-30T02:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AR; asn=28075; asn_org=ARLINK S.A.",
      "id": "indicator--e07b7a2c-9781-4454-ae6b-8d83f41b7efe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T02:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '201.190.185.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T02:05:07.000Z",
      "valid_until": "2026-06-01T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T01:24:12.090Z",
      "x_nadsec_last_seen": "2026-04-30T01:24:12.090Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "28075"
      ],
      "x_nadsec_orgs": [
        "ARLINK S.A."
      ]
    },
    {
      "created": "2026-04-30T02:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--40e40e63-e9d2-4b66-8b55-29e5747a28ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T02:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '61.169.73.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T02:05:07.000Z",
      "valid_until": "2026-06-01T02:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-30T01:45:54.303Z",
      "x_nadsec_last_seen": "2026-04-30T01:53:28.957Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-04-30T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--e3feaaf8-7ec0-4370-b5d3-4938b6cc6a92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T03:05:10.000Z",
      "valid_until": "2026-06-01T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T03:04:00.051Z",
      "x_nadsec_last_seen": "2026-04-30T03:04:00.051Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-30T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3a60fc37-b8b1-4de6-a455-5109f3da3ddb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T03:05:10.000Z",
      "valid_until": "2026-06-01T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T03:03:59.844Z",
      "x_nadsec_last_seen": "2026-04-30T03:03:59.844Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-30T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--a0c6efad-00ef-4ff6-8d79-2eee47c562ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.180.141.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:05:10.000Z",
      "valid_until": "2026-06-01T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T03:27:01.884Z",
      "x_nadsec_last_seen": "2026-04-30T03:27:01.884Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-04-30T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=DE; asn=58212; asn_org=dataforest GmbH",
      "id": "indicator--0fafd49e-2b33-4554-8ae9-37b28f8970ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '193.41.226.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:05:10.000Z",
      "valid_until": "2026-06-01T04:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-30T03:18:34.590Z",
      "x_nadsec_last_seen": "2026-04-30T03:18:36.770Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "58212"
      ],
      "x_nadsec_orgs": [
        "dataforest GmbH"
      ]
    },
    {
      "created": "2026-04-30T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=HK; asn=9269; asn_org=Hong Kong Broadband Network Ltd.",
      "id": "indicator--ae58c6ac-9bc4-41a8-958b-735f6396a769",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '203.186.124.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:05:10.000Z",
      "valid_until": "2026-06-01T04:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-30T03:48:34.546Z",
      "x_nadsec_last_seen": "2026-04-30T03:48:34.616Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9269"
      ],
      "x_nadsec_orgs": [
        "Hong Kong Broadband Network Ltd."
      ]
    },
    {
      "created": "2026-04-30T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=epmapper; ports=135; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--2801715e-dbc6-4f57-9406-57d57852c281",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:05:10.000Z",
      "valid_until": "2026-06-01T04:05:08.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-04-30T03:11:57.388Z",
      "x_nadsec_last_seen": "2026-04-30T03:12:33.396Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-30T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--973802b5-e3d3-4a00-a780-1df6db3615be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '8.216.4.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:05:10.000Z",
      "valid_until": "2026-06-01T04:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-30T04:01:09.828Z",
      "x_nadsec_last_seen": "2026-04-30T04:01:33.596Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-30T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--eeacc2df-9a27-432d-a995-32a09643eede",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '111.93.125.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T06:05:03.000Z",
      "valid_until": "2026-06-01T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-30T05:59:01.721Z",
      "x_nadsec_last_seen": "2026-04-30T06:02:54.464Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-04-30T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=epmapper; ports=135; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--23307edc-dcb9-4939-9f8f-9a0bb56fc662",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.84.142.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T06:05:03.000Z",
      "valid_until": "2026-06-01T06:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-30T05:12:10.733Z",
      "x_nadsec_last_seen": "2026-04-30T05:12:53.391Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-30T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=24835; asn_org=RAYA Telecom - Egypt",
      "id": "indicator--491ce209-92f4-4ca2-90cc-05e03bfc22c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '82.129.237.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T06:05:03.000Z",
      "valid_until": "2026-06-01T06:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-30T05:39:04.323Z",
      "x_nadsec_last_seen": "2026-04-30T05:39:04.382Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24835"
      ],
      "x_nadsec_orgs": [
        "RAYA Telecom - Egypt"
      ]
    },
    {
      "created": "2026-04-30T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--ce2bec05-7ce2-43d9-8e2d-6a20228f8f45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.182.193.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T07:05:02.000Z",
      "valid_until": "2026-06-01T07:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T06:52:09.224Z",
      "x_nadsec_last_seen": "2026-04-30T06:52:09.224Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-30T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--dc6e5fa9-3c84-4220-bbd9-1bddf376db56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '157.230.184.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T07:05:02.000Z",
      "valid_until": "2026-06-01T07:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T06:36:20.767Z",
      "x_nadsec_last_seen": "2026-04-30T06:36:20.767Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-30T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=31; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--8aecf30b-ae30-4f4f-a794-edafc9978f8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '167.99.232.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T07:05:02.000Z",
      "valid_until": "2026-06-01T07:05:00.000Z",
      "x_nadsec_event_count": 31,
      "x_nadsec_first_seen": "2026-04-30T06:33:28.194Z",
      "x_nadsec_last_seen": "2026-04-30T06:36:17.300Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-30T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d213b855-f446-437f-bd4c-6c30c755fe89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.154.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T07:05:02.000Z",
      "valid_until": "2026-06-01T07:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-30T06:12:14.116Z",
      "x_nadsec_last_seen": "2026-04-30T06:12:14.479Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-30T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=mssqld; ports=1433; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--a273f10f-9da5-4919-ba54-14ab97ccb19b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T07:05:02.000Z",
      "valid_until": "2026-06-01T07:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-30T06:21:47.458Z",
      "x_nadsec_last_seen": "2026-04-30T06:23:21.748Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-04-30T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--d2eac234-db9f-4cb5-b7c8-76dbfcb4dc9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T07:05:02.000Z",
      "valid_until": "2026-06-01T07:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-30T06:22:33.259Z",
      "x_nadsec_last_seen": "2026-04-30T06:23:11.203Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-04-30T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--27c7b285-20c4-4738-9b60-6b5c4f638c8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T07:05:02.000Z",
      "valid_until": "2026-06-01T07:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T06:22:13.343Z",
      "x_nadsec_last_seen": "2026-04-30T06:22:13.343Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-04-30T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mssqld; ports=1433; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--c4ffa596-736f-4ab1-ac2e-2a0416435b7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T07:05:02.000Z",
      "valid_until": "2026-06-01T07:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-30T06:21:54.426Z",
      "x_nadsec_last_seen": "2026-04-30T06:23:04.845Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-04-30T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=KZ; asn=41798; asn_org=JSC Transtelecom",
      "id": "indicator--bef5e9af-c028-4fed-bb6a-96ae2299a024",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.255.205.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T07:05:02.000Z",
      "valid_until": "2026-06-01T07:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-30T06:53:23.800Z",
      "x_nadsec_last_seen": "2026-04-30T06:53:28.507Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "41798"
      ],
      "x_nadsec_orgs": [
        "JSC Transtelecom"
      ]
    },
    {
      "created": "2026-04-30T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MA; asn=36903; asn_org=MT-MPLS; user(top)=**",
      "id": "indicator--4720a33c-e24a-4c5c-97cf-80e7338b1e6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '105.155.98.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T08:05:10.000Z",
      "valid_until": "2026-06-01T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T07:33:02.812Z",
      "x_nadsec_last_seen": "2026-04-30T07:33:02.812Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "36903"
      ],
      "x_nadsec_orgs": [
        "MT-MPLS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-30T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--bddd1e2e-89a8-4907-a641-b514b397349e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.191.78.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T08:05:10.000Z",
      "valid_until": "2026-06-01T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-30T07:07:43.799Z",
      "x_nadsec_last_seen": "2026-04-30T07:07:43.870Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-04-30T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--23315c1e-866e-43e9-8435-03537ec29e3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T08:05:10.000Z",
      "valid_until": "2026-06-01T08:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-04-30T07:11:18.412Z",
      "x_nadsec_last_seen": "2026-04-30T07:11:40.213Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-04-30T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--bb65f8c8-1a51-4983-87a6-4a36b93af718",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.180.141.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T09:05:02.000Z",
      "valid_until": "2026-06-01T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T08:41:26.830Z",
      "x_nadsec_last_seen": "2026-04-30T08:41:26.830Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-04-30T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=NL; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--1cf54cc1-db9c-47f0-9a37-b1a34ea733ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '188.166.118.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T09:05:02.000Z",
      "valid_until": "2026-06-01T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T08:36:37.100Z",
      "x_nadsec_last_seen": "2026-04-30T08:36:37.100Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-30T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--83a100e3-51fc-4063-8d59-bec68aed501d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '220.250.45.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T09:05:02.000Z",
      "valid_until": "2026-06-01T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T08:17:39.687Z",
      "x_nadsec_last_seen": "2026-04-30T08:17:39.687Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-04-30T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--610fcd6b-8f1f-4159-ac90-6f21bf25c643",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.38.41.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T09:05:02.000Z",
      "valid_until": "2026-06-01T09:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-30T08:32:18.596Z",
      "x_nadsec_last_seen": "2026-04-30T08:32:33.653Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-04-30T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--54d7c922-5a31-4553-b45b-dedd022b2951",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.77.166.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T09:05:02.000Z",
      "valid_until": "2026-06-01T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T08:55:22.338Z",
      "x_nadsec_last_seen": "2026-04-30T08:55:22.338Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-30T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24186; asn_org=RailTel Corporation of India Ltd",
      "id": "indicator--8cfe3528-3015-430d-a20f-bb83b18fad34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.15.253.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T10:05:02.000Z",
      "valid_until": "2026-06-01T10:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-30T09:17:17.669Z",
      "x_nadsec_last_seen": "2026-04-30T09:19:22.612Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24186"
      ],
      "x_nadsec_orgs": [
        "RailTel Corporation of India Ltd"
      ]
    },
    {
      "created": "2026-04-30T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=151750; asn_org=K-anandraj Inet Solutions Private Limited",
      "id": "indicator--bd8d326f-eb42-4bf7-a560-d27a1e2bdb5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '157.15.234.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T10:05:02.000Z",
      "valid_until": "2026-06-01T10:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-30T10:04:42.279Z",
      "x_nadsec_last_seen": "2026-04-30T10:12:07.803Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "151750"
      ],
      "x_nadsec_orgs": [
        "K-anandraj Inet Solutions Private Limited"
      ]
    },
    {
      "created": "2026-04-30T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BO; asn=26210; asn_org=AXS Bolivia S. A.",
      "id": "indicator--66460b15-0c38-4c66-98c6-f2f76febc4e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.181.58.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T10:05:02.000Z",
      "valid_until": "2026-06-01T10:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-30T09:19:53.097Z",
      "x_nadsec_last_seen": "2026-04-30T09:27:11.422Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "26210"
      ],
      "x_nadsec_orgs": [
        "AXS Bolivia S. A."
      ]
    },
    {
      "created": "2026-04-30T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TR; asn=9121; asn_org=Turk Telekom; user(top)=**",
      "id": "indicator--43e9eae1-91c5-40ba-9e54-3a1cf284e899",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '78.186.26.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T10:05:02.000Z",
      "valid_until": "2026-06-01T10:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-14T19:21:28.016Z",
      "x_nadsec_last_seen": "2026-04-30T09:45:32.715Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-30T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--65e326a9-c838-44b6-8f36-6a9ae71c97ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '81.10.0.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T10:05:02.000Z",
      "valid_until": "2026-06-01T10:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-30T09:37:12.091Z",
      "x_nadsec_last_seen": "2026-04-30T09:45:00.535Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-04-30T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=3216; asn_org=PVimpelCom",
      "id": "indicator--c0a13a9c-9c77-4123-a691-b0135f173e91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.239.208.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T11:05:02.000Z",
      "valid_until": "2026-06-01T11:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-30T10:17:05.147Z",
      "x_nadsec_last_seen": "2026-04-30T10:18:23.374Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "3216"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-04-30T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=16232; asn_org=TIM",
      "id": "indicator--63afb6e7-302f-4e0c-9319-2785d2a8d1d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '2.194.35.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T11:05:02.000Z",
      "valid_until": "2026-06-01T11:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-30T10:53:47.493Z",
      "x_nadsec_last_seen": "2026-04-30T11:01:45.844Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "16232"
      ],
      "x_nadsec_orgs": [
        "TIM"
      ]
    },
    {
      "created": "2026-04-30T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--863b5f89-5e32-49a2-ad38-4b42f11e12e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T11:05:02.000Z",
      "valid_until": "2026-06-01T11:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-30T10:51:27.142Z",
      "x_nadsec_last_seen": "2026-04-30T10:51:37.574Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-30T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AM; asn=12297; asn_org=Telecom Armenia OJSC",
      "id": "indicator--8f32c261-6032-43b6-9348-8d72e27e5394",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '212.73.73.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T11:05:02.000Z",
      "valid_until": "2026-06-01T11:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-30T10:49:26.775Z",
      "x_nadsec_last_seen": "2026-04-30T10:51:33.459Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "12297"
      ],
      "x_nadsec_orgs": [
        "Telecom Armenia OJSC"
      ]
    },
    {
      "created": "2026-04-30T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=CN; asn=134762; asn_org=CHINANET Liaoning province Dalian MAN network",
      "id": "indicator--acbd417f-72aa-4a2b-9961-2ae8e679f085",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '123.185.59.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T12:05:02.000Z",
      "valid_until": "2026-06-01T12:05:00.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-04-30T11:59:50.257Z",
      "x_nadsec_last_seen": "2026-04-30T12:02:53.662Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "134762"
      ],
      "x_nadsec_orgs": [
        "CHINANET Liaoning province Dalian MAN network"
      ]
    },
    {
      "created": "2026-04-30T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VE; asn=269820; asn_org=FULL DATA COMUNICACIONES C.A.",
      "id": "indicator--7fc924b2-45b4-46d7-8cc3-694e428077a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.41.168.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T12:05:02.000Z",
      "valid_until": "2026-06-01T12:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-30T12:02:09.746Z",
      "x_nadsec_last_seen": "2026-04-30T12:04:15.942Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "269820"
      ],
      "x_nadsec_orgs": [
        "FULL DATA COMUNICACIONES C.A."
      ]
    },
    {
      "created": "2026-04-30T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4ef9d0e0-97bc-4bc4-b38e-c96f0be24d2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.80.204.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T12:05:02.000Z",
      "valid_until": "2026-06-01T12:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-30T11:52:28.009Z",
      "x_nadsec_last_seen": "2026-04-30T11:52:38.168Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-30T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--20d6f92c-81c2-4118-a669-33aefac51ada",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.250.84.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T12:05:02.000Z",
      "valid_until": "2026-06-01T12:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-30T11:15:21.086Z",
      "x_nadsec_last_seen": "2026-04-30T11:15:44.664Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-04-30T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--0dddfa4d-022f-45f2-bf5e-756c9e85f790",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.233.97.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T13:05:03.000Z",
      "valid_until": "2026-06-01T13:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-30T12:23:08.311Z",
      "x_nadsec_last_seen": "2026-04-30T12:23:18.503Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-30T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=pptpd; ports=1723; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a5ae844c-a263-497f-8093-23a5fd977507",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '139.59.233.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T13:05:03.000Z",
      "valid_until": "2026-06-01T13:05:00.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-04-30T12:24:39.790Z",
      "x_nadsec_last_seen": "2026-04-30T12:29:44.952Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "27017",
        "38055"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-30T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=8075; asn_org=Microsoft Corporation; user(top)=**; pass(top)=1****6",
      "id": "indicator--c51a3fea-76f7-49c0-aa3d-1fff794e6077",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.40.41.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T13:05:03.000Z",
      "valid_until": "2026-06-01T13:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T12:50:41.417Z",
      "x_nadsec_last_seen": "2026-04-30T12:50:41.417Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6"
      ]
    },
    {
      "created": "2026-04-30T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=8359; asn_org=MTS PJSC",
      "id": "indicator--6bc20397-1d13-49d5-b90f-3d46b71a103a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '212.248.89.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T13:05:03.000Z",
      "valid_until": "2026-06-01T13:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-30T12:26:01.087Z",
      "x_nadsec_last_seen": "2026-04-30T12:27:17.243Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8359"
      ],
      "x_nadsec_orgs": [
        "MTS PJSC"
      ]
    },
    {
      "created": "2026-04-30T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=215925; asn_org=Vpsvault.host Ltd",
      "id": "indicator--f6ef968a-fc8e-466a-9c50-e10f950f9dd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.205.1.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T13:05:03.000Z",
      "valid_until": "2026-06-01T13:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T12:35:50.734Z",
      "x_nadsec_last_seen": "2026-04-30T12:35:50.734Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "215925"
      ],
      "x_nadsec_orgs": [
        "Vpsvault.host Ltd"
      ]
    },
    {
      "created": "2026-04-30T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TR; asn=9121; asn_org=Turk Telekom; user(top)=**",
      "id": "indicator--363ba297-fb4f-4285-8253-8cc9c965d2dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '88.247.20.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T13:05:03.000Z",
      "valid_until": "2026-06-01T13:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T12:49:49.877Z",
      "x_nadsec_last_seen": "2026-04-30T12:49:49.877Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-30T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--fb094704-8803-42a5-b2c4-bf47a215063a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T14:05:02.000Z",
      "valid_until": "2026-06-01T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-30T14:01:44.970Z",
      "x_nadsec_last_seen": "2026-04-30T14:02:17.856Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-30T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a9b0e37d-1524-4d4d-99b8-310883f2efb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.80.83.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T14:05:02.000Z",
      "valid_until": "2026-06-01T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T13:32:03.178Z",
      "x_nadsec_last_seen": "2026-04-30T13:32:03.178Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-30T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--dcbef8fd-c501-4465-865f-3c0640147821",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T14:05:02.000Z",
      "valid_until": "2026-06-01T14:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-30T13:34:54.876Z",
      "x_nadsec_last_seen": "2026-04-30T13:34:55.173Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-04-30T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--66ce8deb-e862-4af9-b618-f7baeca06ab9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '144.172.100.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T15:05:02.000Z",
      "valid_until": "2026-06-01T15:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-04-30T15:02:01.483Z",
      "x_nadsec_last_seen": "2026-04-30T20:58:58.724Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-04-30T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=LU; asn=214472; asn_org=Offshore LC",
      "id": "indicator--55170144-605c-4026-8788-3f7f9eb009b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T15:05:02.000Z",
      "valid_until": "2026-06-01T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T14:47:07.337Z",
      "x_nadsec_last_seen": "2026-04-30T14:47:07.337Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "LU"
      ],
      "x_nadsec_asns": [
        "214472"
      ],
      "x_nadsec_orgs": [
        "Offshore LC"
      ]
    },
    {
      "created": "2026-04-30T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=45769; asn_org=D-Vois Broadband Pvt Ltd",
      "id": "indicator--166cfa19-dddf-4d0f-8359-44e13645dbb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.48.254.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T15:05:02.000Z",
      "valid_until": "2026-06-01T15:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-30T15:04:05.609Z",
      "x_nadsec_last_seen": "2026-04-30T15:10:37.865Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45769"
      ],
      "x_nadsec_orgs": [
        "D-Vois Broadband Pvt Ltd"
      ]
    },
    {
      "created": "2026-04-30T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TJ; asn=51346; asn_org=Opened Joint Stock Company Tojiktelecom",
      "id": "indicator--5de86541-830b-4c38-ada5-e2a23d615ea6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.177.0.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T15:05:02.000Z",
      "valid_until": "2026-06-01T15:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-04-30T14:57:13.031Z",
      "x_nadsec_last_seen": "2026-04-30T15:04:21.457Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TJ"
      ],
      "x_nadsec_asns": [
        "51346"
      ],
      "x_nadsec_orgs": [
        "Opened Joint Stock Company Tojiktelecom"
      ]
    },
    {
      "created": "2026-04-30T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=NL; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--bcc36ac3-4b1b-4c72-88a5-781a0cbb03d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '188.166.67.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T15:05:02.000Z",
      "valid_until": "2026-06-01T15:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-30T14:44:20.605Z",
      "x_nadsec_last_seen": "2026-04-30T14:44:23.911Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-30T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=26599; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--9d457c35-1713-4311-8fa1-06867124e036",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.98.110.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T15:05:02.000Z",
      "valid_until": "2026-06-01T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-30T14:25:01.845Z",
      "x_nadsec_last_seen": "2026-04-30T14:27:09.209Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "26599"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-04-30T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=5573; asn_org=Rostelecom",
      "id": "indicator--dc05f032-5bb6-4afa-9ced-756d2b5103af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.112.230.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T15:05:02.000Z",
      "valid_until": "2026-06-01T15:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-30T14:19:34.418Z",
      "x_nadsec_last_seen": "2026-04-30T14:19:37.433Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "5573"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-04-30T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a68c7932-9d32-4040-9b60-76ff45aafc79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.93.159.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T16:05:10.000Z",
      "valid_until": "2026-06-01T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T15:13:48.889Z",
      "x_nadsec_last_seen": "2026-04-30T15:13:48.889Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-30T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--db1e1c62-42f4-43c1-9890-cd8ba89a6f00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T16:05:10.000Z",
      "valid_until": "2026-06-01T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-30T15:46:49.389Z",
      "x_nadsec_last_seen": "2026-04-30T15:46:59.552Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-30T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=7029; asn_org=Windstream Communications LLC",
      "id": "indicator--a4c7f291-d3c7-491a-acf6-cbd8b47bdaa9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.134.34.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T16:05:10.000Z",
      "valid_until": "2026-06-01T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-30T15:17:26.049Z",
      "x_nadsec_last_seen": "2026-04-30T15:19:31.161Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "7029"
      ],
      "x_nadsec_orgs": [
        "Windstream Communications LLC"
      ]
    },
    {
      "created": "2026-04-30T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=DE; asn=215607; asn_org=dataforest GmbH",
      "id": "indicator--4f12b882-2d4d-4921-9657-25fd66bd2594",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.26.106.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T16:05:10.000Z",
      "valid_until": "2026-06-01T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-30T08:34:11.154Z",
      "x_nadsec_last_seen": "2026-04-30T15:17:43.624Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "215607"
      ],
      "x_nadsec_orgs": [
        "dataforest GmbH"
      ]
    },
    {
      "created": "2026-04-30T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--d6215b4d-a444-435e-a59d-6ff26b5bb1bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.91.72.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T17:05:02.000Z",
      "valid_until": "2026-06-01T17:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-30T16:21:06.211Z",
      "x_nadsec_last_seen": "2026-04-30T16:23:16.660Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-04-30T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--1b5b7c3b-d69d-4934-adb0-b456d1a89805",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '125.227.90.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T17:05:02.000Z",
      "valid_until": "2026-06-01T17:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-30T16:13:26.681Z",
      "x_nadsec_last_seen": "2026-04-30T16:13:28.090Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-30T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--b237e035-325a-40bd-8c61-8e025be67029",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '125.227.91.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T17:05:02.000Z",
      "valid_until": "2026-06-01T17:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-30T16:11:21.987Z",
      "x_nadsec_last_seen": "2026-04-30T16:11:22.265Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-04-30T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--29620663-efab-4f66-8170-45c6002b21ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T17:05:02.000Z",
      "valid_until": "2026-06-01T17:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T16:33:47.982Z",
      "x_nadsec_last_seen": "2026-04-30T16:33:47.982Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-30T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--168cf1eb-f736-4a0e-b1c7-a8650383f172",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T17:05:02.000Z",
      "valid_until": "2026-06-01T17:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T16:33:37.744Z",
      "x_nadsec_last_seen": "2026-04-30T16:33:37.744Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-04-30T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=206092; asn_org=F.n.s. Holdings Limited; user(top)=c**n",
      "id": "indicator--2a68f48b-3970-4244-852d-93e0c347f73e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.8.19.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T17:05:02.000Z",
      "valid_until": "2026-06-01T17:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T16:41:51.884Z",
      "x_nadsec_last_seen": "2026-04-30T16:41:51.884Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "206092"
      ],
      "x_nadsec_orgs": [
        "F.n.s. Holdings Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "c**n"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-30T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=38; services=mirrorc; ports=41013; cc=FR; asn=16276; asn_org=OVH SAS",
      "id": "indicator--39a45b45-38c2-4098-9098-ca15ab59db1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '51.68.207.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T17:05:02.000Z",
      "valid_until": "2026-06-01T17:05:00.000Z",
      "x_nadsec_event_count": 38,
      "x_nadsec_first_seen": "2026-04-30T16:21:16.563Z",
      "x_nadsec_last_seen": "2026-04-30T16:27:35.412Z",
      "x_nadsec_ports": [
        "42",
        "33077",
        "33235",
        "33775",
        "34809",
        "35033",
        "37097",
        "37347",
        "38043",
        "38763"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ]
    },
    {
      "created": "2026-04-30T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--59bcdde5-88cb-44bd-a377-a39b287de6c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '128.1.132.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T18:05:02.000Z",
      "valid_until": "2026-06-01T18:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-30T17:27:03.417Z",
      "x_nadsec_last_seen": "2026-04-30T20:20:00.903Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-30T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0fa8c485-bf96-495a-9953-dbab90baaf31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '137.184.63.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T18:05:02.000Z",
      "valid_until": "2026-06-01T18:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-30T18:02:33.616Z",
      "x_nadsec_last_seen": "2026-04-30T18:02:44.902Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-30T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--fa318bdd-6017-4477-889a-aaaaf0522bb3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.163.15.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T18:05:02.000Z",
      "valid_until": "2026-06-01T18:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-30T17:43:22.539Z",
      "x_nadsec_last_seen": "2026-04-30T17:43:22.829Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-30T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--4c41511a-3b22-4e50-a8a6-3944386b89a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '206.81.1.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T18:05:02.000Z",
      "valid_until": "2026-06-01T18:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T18:02:45.730Z",
      "x_nadsec_last_seen": "2026-04-30T18:02:45.730Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-04-30T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC; user(top)=a*******s; pass(top)=a********@",
      "id": "indicator--07b5d167-ea60-4bb9-9a39-a15c3cc27720",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.205.114.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T18:05:02.000Z",
      "valid_until": "2026-06-01T18:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-30T17:54:42.449Z",
      "x_nadsec_last_seen": "2026-04-30T17:54:42.971Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-04-30T19:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=23694; asn_org=PT Iconmedia Lintas Nusantara",
      "id": "indicator--ff939cb4-35ad-4719-833b-ea5a048e24c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T19:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.66.46.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T19:05:02.000Z",
      "valid_until": "2026-06-01T19:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-30T18:51:03.499Z",
      "x_nadsec_last_seen": "2026-04-30T18:53:07.682Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23694"
      ],
      "x_nadsec_orgs": [
        "PT Iconmedia Lintas Nusantara"
      ]
    },
    {
      "created": "2026-04-30T19:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrord; ports=42; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--ebd23530-7d03-45d4-ba62-661d7e32edf6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T19:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '162.216.149.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T19:05:02.000Z",
      "valid_until": "2026-06-01T19:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-30T18:18:28.504Z",
      "x_nadsec_last_seen": "2026-04-30T18:18:28.508Z",
      "x_nadsec_ports": [
        "42",
        "38993"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-04-30T19:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ES; asn=8560; asn_org=IONOS SE",
      "id": "indicator--07253028-fa65-4337-825e-d0d58b1f5ec5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T19:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '82.223.16.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T19:05:02.000Z",
      "valid_until": "2026-06-01T19:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-30T18:21:37.138Z",
      "x_nadsec_last_seen": "2026-04-30T18:21:37.264Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "8560"
      ],
      "x_nadsec_orgs": [
        "IONOS SE"
      ]
    },
    {
      "created": "2026-04-30T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=AE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--17e69e09-2666-4491-99dd-5038e3f1d08b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.181.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T20:05:02.000Z",
      "valid_until": "2026-06-01T20:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-04-30T19:05:31.971Z",
      "x_nadsec_last_seen": "2026-04-30T19:05:51.979Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-04-30T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=CN; asn=56044; asn_org=China Mobile communications corporation",
      "id": "indicator--5fb0f6db-6680-449b-90bd-8c7b12a53b08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '221.180.254.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T20:05:02.000Z",
      "valid_until": "2026-06-01T20:05:00.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-04-30T19:27:14.928Z",
      "x_nadsec_last_seen": "2026-04-30T19:27:21.520Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56044"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1**1"
      ]
    },
    {
      "created": "2026-04-30T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.; user(top)=a*******s; pass(top)=a********@",
      "id": "indicator--6d86b696-c9b7-4a66-a49d-8a0b55317e87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T20:05:02.000Z",
      "valid_until": "2026-06-01T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T19:06:14.387Z",
      "x_nadsec_last_seen": "2026-04-30T19:06:14.387Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-04-30T21:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4465b0df-1bbc-48d8-bd86-a2595c4bcb37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T21:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T21:05:04.000Z",
      "valid_until": "2026-06-01T21:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T20:46:23.358Z",
      "x_nadsec_last_seen": "2026-04-30T20:46:23.358Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-04-30T21:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--321681fe-e4a3-43a4-bd7c-c5ecbe3bd191",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T21:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.140.129.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T21:05:04.000Z",
      "valid_until": "2026-06-01T21:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T20:56:39.487Z",
      "x_nadsec_last_seen": "2026-04-30T20:56:39.487Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-30T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--ddaa05d4-caf0-4860-81cb-03bb393b80b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '116.62.246.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T22:05:02.000Z",
      "valid_until": "2026-06-01T22:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-30T21:40:56.632Z",
      "x_nadsec_last_seen": "2026-04-30T21:40:56.727Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ]
    },
    {
      "created": "2026-04-30T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=58466; asn_org=CHINANET Guangdong province network; user(top)=r**t",
      "id": "indicator--54061f11-a79d-4544-83cd-11e3e7f8fd54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '106.75.188.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T23:05:10.000Z",
      "valid_until": "2026-06-01T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T22:24:14.679Z",
      "x_nadsec_last_seen": "2026-04-30T22:24:14.679Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "58466"
      ],
      "x_nadsec_orgs": [
        "CHINANET Guangdong province network"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-30T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--5abda58d-b8a6-44f1-87c3-480d157957e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T23:05:10.000Z",
      "valid_until": "2026-06-01T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-04-30T22:23:03.367Z",
      "x_nadsec_last_seen": "2026-04-30T22:23:03.367Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-04-30T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8b397e9f-aba2-4724-b04c-53e4806012ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T23:05:10.000Z",
      "valid_until": "2026-06-01T23:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-04-12T09:34:00.821Z",
      "x_nadsec_last_seen": "2026-04-30T22:32:07.922Z",
      "x_nadsec_ports": [
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    }
  ],
  "spec_version": "2.1",
  "type": "bundle",
  "x_nadsec_enrichment": {
    "enriched_at": "2026-04-30T23:55:56Z",
    "enricher": "enrich_stix_dionaea.py",
    "month": "2026-04",
    "es_host": "http://127.0.0.1:64298",
    "ip_count": 3933,
    "hash_count": 0,
    "enriched_count": 3928
  },
  "x_mitre_attack": {
    "techniques": {
      "T1021.002": {
        "name": "Remote Services: SMB/Windows Admin Shares",
        "tactic": "Lateral Movement",
        "ip_count": 2182,
        "sample_services": []
      },
      "T1190": {
        "name": "Exploit Public-Facing Application",
        "tactic": "Initial Access",
        "ip_count": 951,
        "sample_services": []
      },
      "T1110": {
        "name": "Brute Force",
        "tactic": "Credential Access",
        "ip_count": 405,
        "sample_services": []
      },
      "T1133": {
        "name": "External Remote Services",
        "tactic": "Initial Access",
        "ip_count": 298,
        "sample_services": []
      }
    },
    "tactic_summary": {
      "Lateral Movement": 2182,
      "Initial Access": 1249,
      "Credential Access": 405
    },
    "technique_count": 4,
    "primary_tactics": [
      "Lateral Movement",
      "Initial Access",
      "Credential Access"
    ]
  },
  "x_nadsec_threat_summary": {
    "total_ips": 3928,
    "scored_ips": 3928,
    "threat_distribution": {
      "critical": 675,
      "high": 543,
      "medium": 383,
      "low": 620,
      "minimal": 1707,
      "unknown": 0
    },
    "avg_threat_score": 38.1,
    "max_threat_score": 100,
    "top_threats": [
      {
        "ip": "16.58.56.214",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "3.151.241.153",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "5.187.35.26",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "85.11.183.25",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "85.11.183.21",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "3.134.216.108",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "3.131.220.121",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "193.32.162.28",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "5.61.209.107",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "3.143.162.210",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "80.66.83.43",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "185.224.128.16",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "85.11.183.19",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "18.218.118.203",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "3.130.168.2",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "5.187.35.142",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "18.116.101.220",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "3.129.187.38",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "3.132.26.232",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "115.231.78.11",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      }
    ]
  }
}